CRITICAL🇵🇱 Wersja polska

CVE-2021-45420

CVSS 9.8v3.1pub. 2022-02-14upd. 2026-07-05

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Emerson Dixell Xweb 500

    HW
    Emerson
    wszystkie wersje

  • Emerson Dixell Xweb 500 Firmware

    OS
    Emerson
    wszystkie wersje
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDoS
CWE
References

Related vulnerabilities

CVE-2021-45421HIGH7.5ten sam produkt

Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential att...

CVE-2023-46687CRITICAL9.8PL ✓ten sam vendor

Emerson Rosemount GC370XA/GC700XA/GC1500XA — zdalne RCE jako root bez uwierzytelnienia

CVE-2023-1935CRITICAL9.4ten sam vendor

ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain un...

CVE-2022-30264CRITICAL9.8ten sam vendor

The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They ...

CVE-2020-10640CRITICAL10.0ten sam vendor

Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system p...