CVE-2021-32935
Assigner: icscert
Published: 2022-05-23T18:42:20
State: PUBLISHED
affected: product: In-Sight OPC Server
vendor: Cognex
versions: lessThanOrEqual: v5.7.4 (96)
status: affected
version: All
versionType: custom
credits: value: Amir Preminger of Claroty reported this vulnerability to CISA.
descriptions: value: The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-502
description: CWE-502 Deserialization of Untrusted Data
type: CWE
source: advisory: ICSA-21-224-01
discovery: UNKNOWN
title: Cognex In-Sight OPC Server - Deserialization of Untrusted Data
x_generator: engine: Vulnogram 0.0.9