CVE-2021-32935: The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to…

PriorityP262critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.68%

74.1th percentile

The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cognex	in-sight_opc_server	<= 5.7.4_\(96\)	—
cognex	in-sight_opc_server	All – v5.7.4 (96)	—

Detection & IOCsextracted from sources · hover to see the quote

→Target product is Cognex In-Sight OPC Server v5.7.4 (96) and prior; exploit involves deserialization of untrusted data over the network (AV:N) with no privileges required and user interaction required (UI:R) ↗
→Attack vector is network-based with low attack complexity and no authentication required; monitor for anomalous deserialization payloads sent to the OPC Server service ↗
→No known public exploits exist for this CVE as of the advisory date; focus detection on behavioral indicators such as unexpected privilege escalation from the OPC Server process ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.