CVE-2021-27102highunder attackransomwareCWE-78

CVE-2021-27102

Published · Updated

Follow this CVE+ Monitor FTA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 3.7%
from disclosure to weapon2030 days
Published on NVDFeb 16
1st PoC+2030d
CISA KEV+260d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

Accellion FTA versions up to 9.12.411 have a flaw that allows attackers to run operating system commands through a local web service, potentially giving them full control of the affected system.

Technical detail

CWE-78 OS Command Injection vulnerability in Accellion FTA ≤9.12.411 allows unauthenticated or low-privileged local attackers to execute arbitrary OS commands via improper input validation in a local web service endpoint. Successful exploitation enables remote code execution with system privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.