CVE-2021-21866

August 11, 2021

A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.

Summary:

A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.

Reference Links(if available):

  • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1301
  • https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=
  • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1303

  • CVSS Score (if available)

    v2: / MEDIUM

    v3: /

    Links to Exploits(if available)

  • You may have missed

    image

    [QILIN] – Ransomware Victim: Zimmerman & Frachtman PA Law Firm

    November 22, 2024
    image

    [QILIN] – Ransomware Victim: Calvert Home Mortgage Investment

    November 22, 2024
    image

    [QILIN] – Ransomware Victim: LBCO Contracting LTD

    November 22, 2024
    unlock membership

    Unveiling Blockchain Security: Safeguarding the Digital Ledger

    November 22, 2024
    news

    A Fifth of UK Enterprises Uncertain About NIS2 Compliance Requirements

    November 22, 2024