by Kastro
Paper/Archive/CVE-2021-26622

CVE-2021-26622

Genians Co., Ltd Genian NAC Suite V4.0 — Genian NAC remote code execution vulnerability

EPSS 3%CVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 87.5.875 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.

Affected

ProductAffectedFixed inSource
Genian NAC Suite V4.0unspecified – 4.0.145.0831–CNA
Genian NAC V5.0 & Genian NAC Suite V5.0unspecified – 5.0.42.0827–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
krcert (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refkrcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66580