by Kastro
Paper/Archive/CVE-2021-43936

CVE-2021-43936

Distributed Data Systems WebHMI — Distributed Data Systems WebHM

EPSS 36%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 98.5.985 × 2019.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.

Affected

ProductAffectedFixed inSource
WebHMI4.1 – < 4.14.1CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refus-cert.cisa.gov/ics/advisories/icsa-21-336-03refpacketstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html