CVE-2021-26622: An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers…

PriorityP267critical10CVSS 3.1

AVNACLPRNUINSCCHIHAH

EPSS

2.85%

85.0th percentile

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
genians	genian_nac	4.0 – 4.0.145.0831	—
genians	genian_nac	5.0 – 5.0.42.0827	—
genians_co_ltd	genian_nac_suite_v4.0	unspecified – 4.0.145.0831	—
genians_co_ltd	genian_nac_v5.0_genian_nac_suite_v5.0	unspecified – 5.0.42.0827	—

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.