PT-2021-7988 · Emerson · Emerson Dixell Xweb-500

Published 2021-12-20 · Updated 2024-08-04 · CVE-2021-45420

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Emerson Dixell XWEB-500 (affected versions not specified)

Description The issue is related to an arbitrary file write vulnerability in the /cgi-bin/logo extra upload.cgi, /cgi-bin/cal save.cgi, and /cgi-bin/lo utils.cgi API endpoints. This vulnerability allows an attacker to write any file on the target system without authentication, potentially leading to denial of service and remote code execution. The product has not been supported since 2018.

Recommendations As a temporary workaround, consider disabling the /cgi-bin/logo extra upload.cgi, /cgi-bin/cal save.cgi, and /cgi-bin/lo utils.cgi API endpoints until the issue is resolved. Restrict access to the vulnerable functions to minimize the risk of exploitation. The product should be removed or replaced as it has not been supported since 2018. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-306

CWE-200

CWE-668

Related Identifiers

BDU:2024-00856

CVE-2021-45420

Affected Products

Emerson Dixell Xweb-500

References · 9

• 🔥 https://swascan.com/emerson · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45420 · Security Note
• http://emerson.com · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00856 · Security Note
• https://avd.aquasec.com/nvd/2021/cve-2021-45420 · Note
• http://dixell.com · Note
• https://t.me/cibsecurity/37423 · Telegram Post
• https://vuldb.com/?id.193035 · Note
• https://emerson.com/en-nl · Note