PT-2021-5586

CVE-2021-43936

Published

2021-12-06

Updated

2022-04-12

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebHMI (affected versions not specified)

Description The issue allows an attacker to upload or transfer files of dangerous types to the WebHMI portal. These files may be automatically processed within the product's environment, potentially leading to arbitrary code execution. The vulnerability is related to the lack of restrictions on file uploads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Marcin Dudek

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers

CVE-2021-43936