CVE-2021-43936

Published: Dec 6, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.

Affected (1)

Products: Webhmi: Webhmi Firmware

Webhmi

1 product

Webhmi Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Webhmi Webhmi Firmware	Before 4.1

Running on/with	Platform Versions
Webhmi Webhmi	All versions

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html

Source: ics-cert@hq.dhs.gov

ExploitThird Party AdvisoryVDB Entry

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03

Source: ics-cert@hq.dhs.gov

PatchThird Party AdvisoryUS Government Resource

http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.