CVE-2021-26622

Genian NAC remote code execution vulnerability

State: Published
Severity: 9.6 Critical
Published: Mar 25, 2022
Updated: Aug 3, 2024
Reserved: Feb 3, 2021

Description

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	9.6 Critical	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	krcert

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Genian NAC Suite V4.0Genians Co., Ltd	4.0.145.0831 and earlierAffected
Genian NAC V5.0 & Genian NAC Suite V5.0Genians Co., Ltd	5.0.42.0827 and earlierAffected

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66580

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.