CVE-2021-43936

Distributed Data Systems WebHM

The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.

Affected

Distributed Data Systems · WebHMI

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 HQ

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

35.80% chance of exploitation in the next 30 days, 98th percentile

Published

2021-12-06

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html
• LongWayHomie/CVE-2021-439369★ · 2022-03-29

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50589

Security advisories

• https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03

References

• CVE Record
• NVD entry

Related

• CVE-2017-1000486
• CVE-2017-12617
• CVE-2021-43798
• CVE-2021-43857