PT-2021-7734 · Spacelynk+1 · Spacelynk+1

Published 2021-05-11 · Updated 2021-06-04 · CVE-2021-22736

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions homeLYnk (Wiser For KNX) versions prior to V2.60 spaceLYnk versions prior to V2.60

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. This could cause a denial of service when an unauthorized file is uploaded. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For homeLYnk (Wiser For KNX) versions prior to V2.60, update to a version V2.60 or later. For spaceLYnk versions prior to V2.60, update to a version V2.60 or later. As a temporary workaround, consider restricting file uploads to authorized files only until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-02125

CVE-2021-22736

Affected Products

Homelynk

Spacelynk

References · 6

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22736 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22736 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02125 · Security Note
• https://vuldb.com/ru/?id.175909 · Note
• https://t.me/cvenotify/15569 · Telegram Post