CVE-2021-44207highunder attackCWE-798

CVE-2021-44207

Published · Updated

Follow this CVE+ Monitor USAHERDS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.1epss 18%
from disclosure to weapon
Published on NVDDec 21
CISA KEV+1098d
Action required by CISAfederal deadline: 2025-01-13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.

In short

Acclaim USAHERDS versions up to 7.4.0.1 contain hard-coded credentials that cannot be changed. An attacker who discovers these credentials can gain unauthorized access to the system.

Technical detail

CWE-798 hard-coded credentials in Acclaim USAHERDS ≤7.4.0.1 allow unauthenticated attackers to gain administrative or functional access without requiring credential compromise. Credentials embedded in the application binary or configuration files are static and immutable, enabling persistent unauthorized access.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a