CVE-2021-26473

CRITICAL

Vembu BDR Suite and OffsiteDR < 4.2.0.1 - Unauthenticated Arbitrary File Write via logFilePath Parameter

Title source: llm
STIX 2.1

Description

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_confirm
https://csirt.divd.nl/cases/DIVD-2020-00011/
Third Party Advisory x_refsource_confirm
https://csirt.divd.nl/2021/05/11/Vembu-zero-days/
Broken Link, Third Party Advisory x_refsource_confirm
https://www.wbsec.nl/vembu
Third Party Advisory x_refsource_confirm
https://csirt.divd.nl/cves/CVE-2021-26473/

Scores

CVSS v3 9.8
EPSS 0.0176
EPSS Percentile 75.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (2)
vembu/bdr_suite < 4.2.0.1
vembu/offsite_dr < 4.2.0.1
Published Jun 08, 2021
Tracked Since Feb 18, 2026