CVE-2021-26726

Katalog CVE

CVSS 8.8 · High EPSS 1,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada valmet dna. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.

Rincian

Terbit di NVD

16 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-272: Least Privilege Violation
CWE-305: Authentication Bypass by Primary Weakness
CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.valmet.com/about-us/research-and-development/vulnerabilityadvisories/ advisory vendor
• https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726/ advisory pihak ketiga