Vulnerability · Published Apr 29, 2022 · Assigned by icscert
CVE-2021-43937Elcomplus SmartPTT SCADA Server Cross-site Request Forgery
High 7.6
In plain English
A high-severity information exposure in SmartPTT SCADA Server from Elcomplus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elcomplus | SmartPTT SCADA Server | 1.4 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-05 x_refsource_CONFIRM