Vulnerability Details CVE-2021-21865
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 31.3%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.8
References
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1301
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1301
Products affected by CVE-2021-21865
-
cpe:2.3:a:codesys:development_system:3.5.16.0
-
cpe:2.3:a:codesys:development_system:3.5.17.0