by Kastro
Paper/Archive/CVE-2021-26630

CVE-2021-26630

Handysoft Co.,Ltd HANDY Groupware — HANDY Groupware file download and execute vulnerability

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.0.570 × 2011.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.

Affected

ProductAffectedFixed inSource
HANDY Groupwareunspecified – 1.7.4.6–CNA
HANDY Groupwareunspecified – 2.0.3.6–CNA
HANDY Groupwareunspecified – 4.0.1.7–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

refkrcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66723