CVE-2021-27459: Malicious File Upload
First published: Thu May 20 2021(Updated: )
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The webserver of the affected products allows unvalidated files to be uploaded, which an attacker could utilize to execute arbitrary code.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Emerson X-stream Enhanced Xegp Firmware | ||
| Emerson X-stream Enhanced Xegp | ||
| Emerson X-stream Enhanced Xegk Firmware | ||
| Emerson X-stream Enhanced Xegk | ||
| Emerson X-stream Enhanced Xefd Firmware | ||
| Emerson X-stream Enhanced Xefd | ||
| Emerson X-stream Enhanced Xexf Firmware | ||
| Emerson X-stream Enhanced Xexf | ||
| Emerson X-STREAM enhanced XEGP – all revisions | ||
| Emerson X-STREAM enhanced XEGK – all revisions | ||
| Emerson X-STREAM enhanced XEFD – all revisions | ||
| Emerson X-STREAM enhanced XEXF – all revisions |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-27459.
What products are affected by this vulnerability?
Multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer are affected by this vulnerability.
What is the severity of CVE-2021-27459?
The severity of CVE-2021-27459 is critical with a CVSS score of 9.8.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by uploading unvalidated files to the webserver of the affected products, allowing them to execute arbitrary code.
Is there a fix available for this vulnerability?
Please refer to the vendor's advisory or security bulletin for information on available fixes or patches for this vulnerability.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- agent/trending
- vendor/emerson
- canonical/emerson x-stream enhanced xegp firmware
- canonical/emerson x-stream enhanced xegp
- canonical/emerson x-stream enhanced xegk firmware
- canonical/emerson x-stream enhanced xegk
- canonical/emerson x-stream enhanced xefd firmware
- canonical/emerson x-stream enhanced xefd
- canonical/emerson x-stream enhanced xexf firmware
- canonical/emerson x-stream enhanced xexf
- canonical/emerson x-stream enhanced xegp – all revisions
- canonical/emerson x-stream enhanced xegk – all revisions
- canonical/emerson x-stream enhanced xefd – all revisions
- canonical/emerson x-stream enhanced xexf – all revisions