返回 CVE 浏览器

CVE-2021-26472

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0230%

EPSS Percentile7.16th

Published2021年6月8日

Last Modified2024年11月21日

Vulnerability Description

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.

Affected Platforms (CPE)

📦

Vembu

Bdr Suite

< 4.2.0.1

📦

Vembu

Offsite Dr

< 4.2.0.1

References & Advisories

🔗 https://csirt.divd.nl/2021/05/11/Vembu-zero-days/

🔗 https://csirt.divd.nl/cases/DIVD-2020-00011/

🔗 https://csirt.divd.nl/cves/CVE-2021-26472/

🔗 https://www.wbsec.nl/vembu

🔗 https://csirt.divd.nl/2021/05/11/Vembu-zero-days/

🔗 https://csirt.divd.nl/cases/DIVD-2020-00011/

🔗 https://csirt.divd.nl/cves/CVE-2021-26472/

🔗 https://www.wbsec.nl/vembu

相关漏洞威胁

CVE-2021-021110.0

An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon ...

CVE-2021-2124310.0

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deser...

CVE-2021-3467910.0

Thycotic Password Reset Server before 5.3.0 allows credential disclosure.

CVE-2021-2124410.0

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server sid...