PT-2021-17075 · Handysoft Co. · Handysoft Co.

Published 2021-09-09 · Updated 2022-08-02 · CVE-2021-26608

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions handysoft Co., Ltd groupware (affected versions not specified)

Description The issue is related to an arbitrary file download and execution vulnerability found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This vulnerability is caused by the missing support for integrity checks of the download URL or the downloaded file hash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-353

CWE-345

Related Identifiers

CVE-2021-26608

Affected Products

Handysoft Co.

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-26608 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26608 · Vendor Advisory
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36239 · Note
• https://t.me/cibsecurity/28577 · Telegram Post