Vulnerability in Microsoft Windows
CVE-2021-26625
Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation logic to download and execute arbitrary malicious file.
EPSS: 0.006 (45.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Windows
- Tobesoft Nexacro
- Tobesoft Co.,ltd Nexacro 17 — versions unspecified
Weakness classification (CWE)
References
- vuln@krcert.or.kr (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-26625?
- CVE-2021-26625 is a high-severity vulnerability in Microsoft Windows, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.8/10. Published 2022-04-19.
- How severe is CVE-2021-26625?
- High severity. CVSS v3 base score is 8.8 out of 10.