CVE-2021-35217

Insecure Deserialization of untrusted data causing Remote code execution vulnerability.

High · published September 8, 2021

Patch now

High probability of exploitation

CVSS calls it high at 8.9. It sits in the 99.5th percentile for exploit probability.

CVSS v3.1
8.9
EPSS
73%
Percentile
99.5
In the wild
Unconfirmed
What it is

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.72792 · 99.5th percentile
Published
2021-09-08T13:15Z
EPSS history
Timeline
  • 08 SEP 13:15Z
    Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
    cvelistv5