Lucene search

[email protected]CVE-2021-26622

HistoryMar 25, 2022 - 7:15 p.m.

CVE-2021-26622

2022-03-2519:15:08

CWE-94

CWE-20

[email protected]

web.nvd.nist.gov

cve-2021-26622

genian nac

remote code execution

ssti

file name parameter validation

nvd

vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.3%

JSON

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.

Affected configurations

NVD

Node

geniansgenian_nacRange4.0–4.0.145.0831

geniansgenian_nacRange5.0–5.0.42.0827

AND

microsoftwindowsMatch-

CPENameOperatorVersion
genians:genian_nacgenians genian nacle4.0.145.0831
genians:genian_nacgenians genian nacle5.0.42.0827

CPE	Name	Operator	Version
genians:genian_nac	genians genian nac	le	4.0.145.0831
genians:genian_nac	genians genian nac	le	5.0.42.0827

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "Genian NAC Suite V4.0",
    "vendor": "Genians Co., Ltd",
    "versions": [
      {
        "lessThanOrEqual": "4.0.145.0831",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "Windows"
    ],
    "product": "Genian NAC V5.0 & Genian NAC Suite V5.0",
    "vendor": "Genians Co., Ltd",
    "versions": [
      {
        "lessThanOrEqual": "5.0.42.0827",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66580

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.3%

JSON

Related for CVE-2021-26622

nvd1 prion1 cvelist1