PT-2021-24237 · Emerson · Emerson Xweb 300D Evo

Published 2021-12-30 · Updated 2022-01-11 · CVE-2021-45427

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Emerson XWEB 300D EVO version 3.0.7--3ee403

Description: The issue allows for unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal.

Recommendations: For Emerson XWEB 300D EVO version 3.0.7--3ee403, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability to delete files without proper authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-45427

Affected Products

Emerson Xweb 300D Evo

References · 7

• 🔥 https://drive.google.com/file/d/1iusYdheb62dom0DnvAzEiNR-e4EXSf2k/view?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2021-45427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45427 · Security Note
• https://t.me/cibsecurity/34752 · Telegram Post
• https://t.me/cvenotify/25240 · Telegram Post
• https://drive.google.com/file/d/1IN7p9OKRgdszMVC1TKuZQDa4ySCPmQzO/view?usp=sharing · Note
• https://drive.google.com/file/d/1RegGlCrtyQwW9DUirAbPDiIHKBWgsBea/view?usp=sharing · Note