Actively exploited · Published May 27, 2021 · Assigned by certcc
CVE-2021-27852
Critical 9.8 Exploited
In plain English
A critical-severity unsafe deserialization in Survey from Checkbox. Attackers are actively exploiting it in the wild (listed by CISA on April 11, 2022). The chance it is exploited in the next 30 days is estimated at 30.3% (higher than 98% of all known vulnerabilities). Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
CISA guidance
Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
Federal agencies must remediate by May 2, 2022.
Official description
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H