CVE-2021-44750 Arbitrary Code Execution
A standard user can execute arbitrary commands with administrator privileges by crafting a malicious configuration file for the F-Secure Support Tool.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-44750?
CVE-2021-44750 is a medium-severity code injection vulnerability in F-Secure Elements Agent, F-Secure MDR, F-Secure Client Security, F-Secure Server Security, F-Secure Email and Server Security, F-Secure Freedome VPN, F-Secure SAFE, F-Secure KEY, and F-Secure Internet Security / Anti-Virus, published on 9 Mar 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands.
Which versions are affected by CVE-2021-44750?
It affects 5 products.
Products include F-Secure Client Security, F-Secure Countercept, F-Secure Elements, F-Secure Email and Server Security, F-Secure Server Security.
How do I fix CVE-2021-44750?
No fix has been published for CVE-2021-44750 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-44750 being exploited?
There is no known exploitation of CVE-2021-44750 in the wild and no public exploit code.
Other vulnerabilities in F-Secure Elements Agent, F-Secure MDR, F-Secure Client Security, F-Secure Server Security, F-Secure Email and Server Security, F-Secure Freedome VPN, F-Secure SAFE, F-Secure KEY, and F-Secure Internet Security / Anti-Virus
Sources
Also known as GHSA-c462-j9h8-8xrx.