CVE-2021-45420

Katalog CVE

CVSS 9.8 · Critical EPSS 17,5%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada emerson dixell xweb-500 firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.

Rincian

Terbit di NVD

14 Februari 2022

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-306: Missing Authentication for Critical Function
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

17,5% peluang dieksploitasi; lebih tinggi dari 97,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.swascan.com/emerson exploit · advisory pihak ketiga