CVE-2021-22646

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-226477.8Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1CVE-2021-226489.8Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.CVE-2021-226497.8Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1CVE-2021-226509.8An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could leCVE-2021-226517.8When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot NCVE-2021-226529.8Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacCVE-2021-226537.8Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft aCVE-2021-226547.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose inforCVE-2021-226557.8Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a CVE-2021-226567.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.CVE-2021-226579.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrCVE-2021-226589.8Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Adm
CVE-2021-22646: Critical severity, CVSS 9.8 | Vulnix