CVE-2021-43936

The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

35.80% chance of exploitation in the next 30 days, 98th percentile

Published

2021-12-06

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html
• LongWayHomie/CVE-2021-439369★ · 2022-03-29

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50589

References

• CVE Record
• NVD entry

Related

• CVE-2017-1000486
• CVE-2017-12617
• CVE-2021-43798
• CVE-2021-43857
• CVE-2022-27434
• CVE-2021-4393