Vulnerability · Published Feb 11, 2022 · Assigned by schneider
CVE-2021-22803
Critical 9.8
In plain English
A critical-severity unrestricted file upload in Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).
Official description
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders in context of the DC module, by sending constructed messages on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior) | Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior) |
Weakness: CWE-434