Riskcovery

CVE-2021-26726

Remote code execution in Valmet DNA before Collection 2021

State
Published
Severity
8.8 High
Published
Feb 16, 2022
Updated
Sep 17, 2024
Reserved
Feb 5, 2021

Read the record on cve.org

Description

A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNozomi

Weaknesses

  • CWE-305 Authentication Bypass by Primary Weakness
  • CWE-209 Information Exposure Through an Error Message
  • CWE-272 Least Privilege Violation
  • CWE-78 OS Command Injection

Affected Products

ProductVersions
Valmet DNAValmet DNA
  • Collection 2012 to before Collection 2021Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.