Vulnerability · Published Feb 16, 2022 · Assigned by Nozomi
CVE-2021-26726Remote code execution in Valmet DNA before Collection 2021
High 8.8
In plain English
A high-severity OS command injection in Valmet DNA from Valmet DNA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 33.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Valmet DNA | Valmet DNA | Collection 2012 – before Collection 2021 |
Weakness: CWE-305, CWE-209, CWE-272, CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H