CVE-2021-26608CWE-353

handysoft groupware arbitrary file download and execution vulnerability

High · published September 9, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00595 · 47.7th percentile
Weakness
CWE-353 · Missing Support for Integrity Check
Published
2021-09-09T12:54Z
EPSS history
Timeline
  • 09 SEP 12:54Z
    handysoft groupware arbitrary file download and execution vulnerability
    cvelistv5