Lucene search

MitreCVELIST:CVE-2021-26472

HistoryJun 08, 2021 - 6:37 p.m.

CVE-2021-26472 Unauthenticated remote command execution with SYSTEM privileges in Vembu products

2021-06-0818:37:29

mitre

www.cve.org

cve-2021-26472

vembubdr

vembuoffsitedr

windows

http api

unauthenticated attacker

arbitrary os commands

system privileges

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.017

Percentile

87.7%

JSON

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.

References

csirt.divd.nl/2021/05/11/Vembu-zero-days/

csirt.divd.nl/cases/DIVD-2020-00011/

csirt.divd.nl/cves/CVE-2021-26472/

www.wbsec.nl/vembu

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.017

Percentile

87.7%

JSON

Related for CVELIST:CVE-2021-26472