PT-2021-21657 · Nch · Nch Ivm Attendant

Published 2021-07-25 · Updated 2021-07-30 · CVE-2021-37444

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NCH IVM Attendant versions 5.12 and earlier

Description The issue is related to a directory traversal weakness when uploading plugins in a ZIP archive. This weakness can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the inbuilt Autodial function.

Recommendations For versions 5.12 and earlier, consider disabling the plugin upload feature until a patch is available to prevent potential code execution. Restrict access to the ZIP archive upload functionality to minimize the risk of exploitation. Avoid using the pathname parameter in the ZIP element to prevent directory traversal.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2021-37444

Affected Products

Nch Ivm Attendant

References · 7

• 🔥 https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_RCE.md · Exploit
• https://osv.dev/vulnerability/CVE-2021-37444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37444 · Security Note
• https://nch.com.au/ivm/index.html · Note
• https://t.me/cvenotify/18100 · Telegram Post
• https://t.me/cvenotify/18365 · Telegram Post
• https://t.me/cibsecurity/26466 · Telegram Post