PT-2022-9787 · Wisa · Wisa Smart Wing Cms

Published 2022-08-17 · Updated 2022-08-24 · CVE-2021-26639

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WISA Smart Wing CMS (affected versions not specified)

Description The issue is caused by the lack of validation of input values for specific functions in WISA Smart Wing CMS. Remote attackers can exploit this to leak all files on the server without needing to log in to the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-494

CWE-20

Related Identifiers

CVE-2021-26639

Affected Products

Wisa Smart Wing Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-26639 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26639 · Vendor Advisory
• https://t.me/cibsecurity/48308 · Telegram Post
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66875 · Note