CVE-2021-21866: codesys development_system Deserialization of Untrusted Data

Vulnerability summary

CVE-2021-21866 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in codesys development_system. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-08-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.