CVE-2021-22502 is an unauthenticated OS command injection flaw (CWE-78) in Micro Focus Operation Bridge Reporter (OBR) version 10.40, rated critical (CVSS 9.8) because it is reachable over the network with no privileges or user interaction required. By sending crafted input to the exposed OBR service, an attacker can inject operating-system commands that are executed directly on the OBR server. Successful exploitation yields full remote code execution with the privileges of the affected service, giving attackers a foothold in enterprise IT operations environments. Organizations running OBR 10.40 — an enterprise IT-operations analytics/reporting server — are affected, particularly where the OBR interface is reachable from untrusted networks. Exploitation status is high-concern: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, a public proof-of-concept for unauthenticated command injection exists, and EPSS puts the 30-day exploitation probability at 96.7% (top percentile).
What to do: Apply the vendor update for Operation Bridge Reporter per Micro Focus/OpenText instructions, as required by the CISA KEV catalog; confirm the deployed OBR build resolves 10.40. Until patched, restrict network access to the OBR server (firewall rules, VPN-only access) and hunt for signs of compromise such as unexpected processes, suspicious outbound connections, or web-shell artifacts on the server.
Affected
Micro Focus Operation Bridge Reporter (OBR)
10.40
Estimated exposure
moderatelikely on the order of thousands of enterprise deployments worldwide (roughly 1,000–10,000 systems), with only a fraction internet-exposed; exact counts unknown — OBR is a specialized enterprise IT-operations analytics server sold to large organizations rather than mass-market software, so the installed base is plausibly in the low thousands and public-scan internet exposure is likely far lower.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.
Unit 42 observed attacks exploiting VisualDoor (SonicWall SSL-VPN), CVE-2020-25506 (D-Link DNS-320), CVE-2020-26919 (Netgear ProSAFE Plus), and other flaws, with infrastructure rotating across at least three IP addresses between February 16 and March 13, 2021. Payloads were updated hours after CVE-2021-27561 and CVE-2021-27562 (Yealink Device Management, unauthenticated root RCE) and later added CVE-2021-22502 (Micro Focus Operation Bridge Reporter) and CVE-2019-19356 (Netis WF2419). Successful exploitation invokes wget to fetch shell scripts that download Mirai binaries compiled for multiple architectures and brute-forcers, and attacks were still ongoing when reported.