Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2021-26472

Unauthenticated remote command execution with SYSTEM privileges in Vembu products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a n/a

  • n/aaffected

References