Vulnerability · Published Aug 31, 2021 · Assigned by mitre

CVE-2021-36356

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 54.4% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)54.4%top 1.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://write-up.github.io/kramerav/ x_refsource_MISC
http://packetstormsecurity.com/files/166623/Kramer-VIAware-Remote-Code-Execution.html x_refsource_MISC