Vulnerability · Published Feb 26, 2021 · Assigned by mitre

CVE-2021-27198

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.7% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)12.7%top 3.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM, which means that exploitation gives one Administrator privileges on the target system.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://myconnectionserver.visualware.com/download.html x_refsource_MISC
https://myconnectionserver.visualware.com/support/newrelease.html x_refsource_MISC
20210226 VisualWare MyConnection Server 11.x Remote Code Execution Vulnerability mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/161571/VisualWare-MyConnection-Server-11.x-Remote-Code-Execution.html x_refsource_MISC
https://www.securifera.com/advisories/cve-2021-27198/ x_refsource_MISC