{"cve":"CVE-2021-33205","nvd":{"published":"2021-06-11T12:15:12.093","modified":"2026-06-17T03:54:21.147","status":"Modified","description":"Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":[],"references":["https://www.westerndigital.com/support/productsecurity/wdc-21007-edgerover-windows-app-ver-0-25","https://www.westerndigital.com/support/productsecurity/wdc-21007-edgerover-windows-app-ver-0-25"],"products":["westerndigital:edgerover"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-33205","score":0.00967,"percentile":0.61817,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}