CVE-2021-27461 Path traversal in Emerson Rosemount X-STREAM Gas Analyzer

High 7.5 Published 20 May 2021 Updated 3 Aug 2024

Attackers can access stored data on Emerson Rosemount X-STREAM Gas Analyzers by using specially crafted URLs due to a path traversal vulnerability.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27461?

CVE-2021-27461 is a high-severity path traversal vulnerability in Emerson Rosemount X-STREAM Gas Analyzer, published on 20 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected webserver applications allow access to stored data that can be obtained by using specially crafted URLs.

Weakness: CWE-22

Which versions are affected by CVE-2021-27461?

It affects 4 products.

Products include Emerson X-Stream Enhanced Xefd Firmware, Emerson X-Stream Enhanced Xegk Firmware, Emerson X-Stream Enhanced Xegp Firmware, Emerson X-Stream Enhanced Xexf Firmware.

How do I fix CVE-2021-27461?

No fix has been published for CVE-2021-27461 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-27461 being exploited?

There is no known exploitation of CVE-2021-27461 in the wild and no public exploit code.

Sources

Also known as GHSA-3p4j-j4x8-76j4.