Distributed Data Systems WebHMI
Advisory ansehen veröffentlicht 2021-12-02
Successful exploitation of these vulnerabilities could allow an administrator account login without password authentication and remote code execution with root privileges.
01
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-43936US | critical9.8 | Exploit | ||
The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead t… | ||||
| CVE-2021-43931US | critical9.8 | — | ||
The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (2)
- MitigationWebHMI
Upgrading the platform software to the latest release, Version 4.1
http://webhmi.com.ua/en/2021/09/new-webhmi-firmware-release-4-1/ - MitigationWebHMI
Upgrading the platform software to the latest release, Version 4.1
http://webhmi.com.ua/en/2021/09/new-webhmi-firmware-release-4-1/
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan