ZeroDay Findings
Sign inSign up

Findings

CVE-2021-44228

Apache Log4j2 Remote Code Execution Vulnerability

Published Dec 10, 2021 · updated Aug 11, 2026 · siemens 6bk1602-0aa12-0tp0 firmware

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2021 · Catalog

    Detected

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is en

  2. Dec 10, 2021 · CISA KEV

    Known exploited

    For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

  3. Dec 24, 2021 · CISA KEV

    Remediation due

    For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

  4. Aug 11, 2026 · Catalog

    Updated

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is en

Required action

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

CISA due date Dec 24, 2021

Affected

  • cpe apache/log4jversion unspecified
  • cpe debian/debian linux9.0
  • cpe intel/computer vision annotation toolversion unspecified
  • cpe siemens/6bk1602-0aa12-0tp0 firmwareversion unspecified
  • cpe siemens/6bk1602-0aa22-0tp0 firmwareversion unspecified
  • cpe siemens/6bk1602-0aa32-0tp0 firmwareversion unspecified
  • cpe siemens/6bk1602-0aa42-0tp0 firmwareversion unspecified
  • cpe siemens/6bk1602-0aa52-0tp0 firmwareversion unspecified
  • cpe siemens/capitalversion unspecified
  • cpe siemens/sppa-t3000 ses3000 firmwareversion unspecified
  • vendor Apache Log4j2version unspecified

Sources

  • CISA KEVCVE-2021-44228

    Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

    cisa.gov
  • CVE.orgCVE-2021-44228

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-44228

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database50590

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database50592

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database51183

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_scanner/http/log4shell_scanner

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_linux/http/mobileiron_core_log4shell

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_multi/http/log4shell_header_injection

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-44228

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messa

    nvd.nist.gov

References