Distributed Data Systems WebHMI
view advisory published 2021-12-02
Successful exploitation of these vulnerabilities could allow an administrator account login without password authentication and remote code execution with root privileges.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-43936US | critical9.8 | Exploit | ||
The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead t… | ||||
| CVE-2021-43931US | critical9.8 | — | ||
The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- MitigationWebHMI
Upgrading the platform software to the latest release, Version 4.1
http://webhmi.com.ua/en/2021/09/new-webhmi-firmware-release-4-1/ - MitigationWebHMI
Upgrading the platform software to the latest release, Version 4.1
http://webhmi.com.ua/en/2021/09/new-webhmi-firmware-release-4-1/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan