CVE-2021-41578

HIGH

mySCADA myDESIGNER <= 8.20.0 - Path Traversal and Arbitrary File Write via Project File Import

Title source: llm

Description

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead to code execution.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://github.com/jacob-baines/vuln_disclosure/blob/main/vuln_2021_05.txt

View Writeup ZIP pw:eip

Scores

CVSS v3 7.8

EPSS 0.1045

EPSS Percentile 95.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-22

Status published

Products (1)

myscada/mydesigner < 8.20.0

Published Oct 04, 2021

Tracked Since Feb 18, 2026