PT-2022-4957 · Valmet · Valmet Dna

Published 2022-01-28 · Updated 2023-06-30 · CVE-2021-26726

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Valmet DNA versions from Collection 2012 until Collection 2021

Description A remote code execution issue affects a Valmet DNA service listening on TCP port 1517, allowing an attacker to execute commands with SYSTEM privileges. The vulnerability is related to the lack of protection for transmitted data, which can enable a remote attacker to elevate their privileges in the system.

Recommendations For Valmet DNA versions from Collection 2012 until Collection 2021, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Use of Insufficiently Random Values

Generation of Error Message Containing Sensitive Information

OS Command Injection

Weakness Enumeration

CWE-305

CWE-272

CWE-319

CWE-330

CWE-209

CWE-78

Related Identifiers

BDU:2022-06151

CVE-2021-26726

Affected Products

Valmet Dna

References · 7

• https://valmet.com/about-us/research-and-development/vulnerabilityadvisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26726 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06151 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26726 · Security Note
• https://valmet.com/about-us/research-and-development/vulnerabilityadvisories/valmet-dna-remote-code-execution · Note
• https://nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726 · Note
• https://t.me/cibsecurity/37572 · Telegram Post