{"schemaVersion":3,"id":"CVE-2021-45420","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.","dates":{"published":"2022-02-14T13:08:52.000Z","modified":"2026-07-09T00:16:07.939Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.1755,"percentile":0.97134,"severity":"medium","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.1755},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.1755,"percentile":0.97134}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.1755,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.1755,"percentile":0.97134}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_A9DBC6DAC36255DE","name":"Exploit Reference (swascan.com)","source":"reference","url":"https://www.swascan.com/emerson","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"},{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"},{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere","description":"The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/668.html"}],"affected":[{"vendor":"emerson","product":"dixell_xweb-500_firmware","name":"dixell xweb-500 firmware","label":"dixell_xweb-500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/emerson/dixell_xweb-500"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.swascan.com/emerson","label":"www.swascan.com/emerson","hostname":"www.swascan.com","tags":["Exploit","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-02-14T13:08:52.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-09T00:16:07.939Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T18:03:47.542Z","stale":false,"partial":false}}