CVE-2021-24112

highpriority · track · 31EPSS 0.035 · 89 %ileCHDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.45% (89th) EPSS

CVSS 7.5 · high

Is it mine?

59 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

.NET Core Remote Code Execution Vulnerability

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedLabX Standardmettler_toledo_psirt
Update to LabX Standard v21.4.23

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

v3.18.1highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 2.2 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Mettler-Toledo PSIRT

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 3.9 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-94USCWE-94US

affected products (59)

Products and version ranges known to be affected.

F5 BIG-IPall versionscert_bundDEcpe:/a:f5:big-ip:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
IBM Security Guardium 12.0all versionscert_bundDEcpe:/a:ibm:security_guardium:12.0
NetApp ActiveIQ Unified Manager for Microsoft Windowsall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows
NetApp ActiveIQ Unified Manager for VMware vSphereall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere
Oracle MySQL 8.4.1all versionscert_bundDEcpe:/a:oracle:mysql:8.4.1
Oracle MySQL 9.0.0all versionscert_bundDEcpe:/a:oracle:mysql:9.0.0
Oracle MySQL <=7.5.34all versionscert_bundDE
Oracle MySQL <=7.6.30all versionscert_bundDE
Oracle MySQL <=8.0.34all versionscert_bundDE
Oracle MySQL <=8.0.35all versionscert_bundDE
Oracle MySQL <=8.0.36all versionscert_bundDE
Oracle MySQL <=8.0.37all versionscert_bundDE
Oracle MySQL <=8.0.38all versionscert_bundDE
Oracle MySQL <=8.1.0all versionscert_bundDE
Oracle MySQL <=8.2.0all versionscert_bundDE
Oracle MySQL <=8.3.0all versionscert_bundDE
Oracle MySQL <=8.4.0all versionscert_bundDE
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Xerox FreeFlow Print Server v9 for Solarisall versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v9_for_solaris

showing 20 of 59

advisories (7)

Vendor and ecosystem advisories describing this.

NCSC-2024-0303Kwetsbaarheden verholpen in Oracle MySQLNL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle MySQL.
VDE-2026-064METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.32026-06-09csaf · mettler_toledo_psirtCH
Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases. Notice: LabX Standard was formerly known as LabX Cloud Local.
WID-SEC-W-2023-1805Oracle Hyperion: Mehrere SchwachstellenDeutsch2023-07-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Hyperion ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-1656Oracle MySQL: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-rxg9-xrhp-64gj.NET Core Remote Code Execution Vulnerability2022-05-24ghsa · osvUS
A remote code execution vulnerability exists when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. This CVE ID is unique from CVE-2021-26701.
BIT-dotnet-2021-24112.NET Core Remote Code Execution Vulnerability2024-03-06vendor · osvUS
.NET Core Remote Code Execution Vulnerability
BIT-dotnet-sdk-2021-24112.NET Core Remote Code Execution Vulnerability2024-03-06vendor · osvUS
.NET Core Remote Code Execution Vulnerability

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl mettler_toledo_psirt NVD CVE.org MITRE

published 2021-02-25modified 2026-10-07

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan