PT-2022-9774 · Nexacro · Nexacro

Published 2022-04-19 · Updated 2022-04-27 · CVE-2021-26625

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nexacro platform (affected versions not specified)

Description The issue is related to insufficient verification of input data, which can lead to arbitrary file download and execution. This is caused by an automatic update function that fails to properly validate input data, except for version information. As a result, remote attackers can exploit this incomplete validation logic to download and execute arbitrary malicious files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2021-26625

Affected Products

Nexacro

References · 3

• https://osv.dev/vulnerability/CVE-2021-26625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26625 · Security Note
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66661 · Note