by Kastro
Paper/Archive/CVE-2021-26612

CVE-2021-26612

TOBESOFT NEXACRO17 — tobesoft Nexacro platform arbitrary file creation vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.2.682 × 2013.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.

Affected

ProductAffectedFixed inSource
NEXACRO1717.1.2.500 – 17.1.2.500–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

refboho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36380