CVE-2021-43555

HIGH

7.3

Description

mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path traversal payload. This vulnerability may allow an attacker to plant files on the file system in arbitrary locations or overwrite existing files, resulting in remote code execution.

Details CVE

Score CVSS v3.17.3

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Vecteur d'attaqueLOCAL

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie11/19/2021

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

myscada:mydesigner

Faiblesses (CWE)

CWE-23CWE-22

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-313-04(ics-cert@hq.dhs.gov)

https://us-cert.cisa.gov/ics/advisories/icsa-21-313-04(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.