CVE-2021-45420: Infoleak

Published Feb 14, 2022

Updated

UNSUPPORTED WHEN ASSIGNED Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.

Affected Software

4 affected components

All of the following

Emerson Dixell XWEB-500

Emerson Dixell Xweb-500 Firmware

Emerson Dixell XWEB-500

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Emerson Dixell XWEB-500 from your environment.
Remove or replace the Emerson Dixell XWEB-500 product, since it has not been supported since 2018 and is affected by the arbitrary file write vulnerability.

Event History

Feb 14, 2022

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-45420 vulnerability?

CVE-2021-45420 is an arbitrary file write vulnerability affecting Emerson Dixell XWEB-500 products.

How severe is CVE-2021-45420 vulnerability?

CVE-2021-45420 has a severity rating of 9.8 (critical).

Which software is affected by CVE-2021-45420 vulnerability?

Emerson Dixell XWEB-500 firmware is affected by CVE-2021-45420.

How can an attacker exploit CVE-2021-45420 vulnerability?

An attacker can exploit CVE-2021-45420 to write any file on the target system without authentication.

Are there any references for CVE-2021-45420 vulnerability?

Yes, you can find more information about CVE-2021-45420 on the following websites: Dixell (dixell.com), Emerson (emerson.com), and Swascan (swascan.com).