CVE-2021-26626
Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.25% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- tobesoft/xplatform
- Source
- vuln@krcert.or.kr
References
- https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662Third Party Advisory
- https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.