CVE-2021-26726CWE-209CWE-272CWE-305CWE-78

Remote code execution in Valmet DNA before Collection 2021

High · published February 16, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
66.5
In the wild
Unconfirmed
What it is

A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01148 · 66.5th percentile
Weaknesses
CWE-209 · Generation of Error Message Containing Sensitive Information; CWE-272 · Least Privilege Violation; CWE-305 · Authentication Bypass by Primary Weakness; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-02-16T15:15Z
EPSS history
Timeline
  • 16 FEB 15:15Z
    Remote code execution in Valmet DNA before Collection 2021
    cvelistv5