CVE-2021-26626: Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the…

PriorityP352high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

1.17%

63.4th percentile

Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tobesoft	xplatform	< 9.2.2.280	9.2.2.280
tobesoft_co_ltd	xplatform	>= unspecified < 9.2.2.280	9.2.2.280

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.