Skip to content
COOEY

EXPOSURES › CVE-2021-45420

CVE-2021-45420

CRITICAL
DETAIL
SourceNVD · cve Published2022-02-14 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2021-45420 ↗
⚡ RCE SHAME 50/100 rce

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, a

▸ RECOMMENDED ACTION  Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED
emerson · vendordixell xweb-500 · productdixell xweb-500 firmware · product
DESCRIPTION

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.