CVE-2021-43930

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system...

Code injection

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page...

Design/Logic Flaw

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files...

Path traversal

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system...

CVE-2021-43939

CVE-2021-43939 affects Elcomplus SmartPTT (SCADA/server endpoints). The vulnerability is improper authorization (CWE-285) that lets a low-authenticated user issue requests to admin-level endpoints, enabling privilege escalation with high impact to confidentiality, integrity and availability. Affe...

CVE-2021-43939 Elcomplus SmartPtt Improper Authorization

Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints...

CVE-2021-43939 Elcomplus SmartPtt Improper Authorization

Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints...

CVE-2021-43932 Elcomplus SmartPtt Cross-site Scripting

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page...

CVE-2021-43932 Elcomplus SmartPtt Cross-site Scripting

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page...

CVE-2021-43932

CVE-2021-43932 affects Elcomplus SmartPTT SCADA Server (notably SmartPTT SCADA Server v1.4) where an attacker can inject JavaScript into a parameter that executes when accessing the dashboard or main page. Root cause: CWE-79 (Cross‑Site Scripting) due to improper input neutralization. Impact per ...

CVE-2021-43934

CVE-2021-43934 affects Elcomplus SmartPTT SCADA/SCADA Server (SmartPTT SCADA Server v1.4; SmartPTT) where the backup and restore/upload functionality does not adequately validate uploads, enabling an attacker to upload arbitrary files (Unrestricted Upload of File with Dangerous Type). The CVSS v3...

CVE-2021-43934 Elcomplus SmartPtt Unrestricted Upload of File with Dangerous Type

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files...

CVE-2021-43930 Elcomplus SmartPtt Path Traversal

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system...

CVE-2021-43930

CVE-2021-43930 affects Elcomplus SmartPTT/SmartPTT SCADA Server backup and restore functionality. The root cause is improper validation of download requests in the backup/restore path traversal flow, enabling an attacker to access files outside the intended directory. Exploitation could allow dow...

CVE-2021-43939: Improper Authorization

Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints...

CVE-2021-43932: Improper Neutralization of Input During Web Page Generation

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page...

CVE-2021-43930: Improper Limitation of a Pathname to a Restricted Directory

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system...

CVE-2021-43934: Unrestricted Upload of File with Dangerous Type

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files...

Elcomplus SmartPPT Server Code Execution

The vulnerability of the update loading function of the Elcomplus SmartPPT server lies in the ability to download files of a dangerous type without limitation. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Elcomplus SmartPPT SCADA File Write

The vulnerability of the Elcomplus SmartPPT SCADA server is related to input validation errors. Exploiting this vulnerability allows a malicious actor to write arbitrary files to arbitrary locations in the file system using a specially created HTTP request...