CVE-2021-45420 File upload in n/a
Unauthenticated attackers can write arbitrary files on Emerson Dixell XWEB-500 devices, leading to denial of service or remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-45420?
CVE-2021-45420 is a critical vulnerability in n/a, published on 14 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.
Which versions are affected by CVE-2021-45420?
It affects 1 product.
Products include Emerson Dixell Xweb-500 Firmware.
How do I fix CVE-2021-45420?
No fix has been published for CVE-2021-45420 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-45420 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-45420 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mvgm-c55v-5wjw.