CVE-2021-22651

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are, while processing the extraction of temporary files, suffering from a directory traversal vulnerability, which allows an attacker to store arbitrary scripts into automatic startup folders.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	Luxion KeyShot versions	versions prior to 10.1
n/a	Luxion KeyShot Viewer	versions prior to 10.1
n/a	Luxion KeyShot Network Rendering	versions prior to 10.1
n/a	Luxion KeyVR	versions prior to 10.1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdfThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01Patch, Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-324/Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdfThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01Patch, Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-324/Third Party Advisory, VDB Entry

Timeline

Published: Feb 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-226529.8Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attac CVE-2021-226537.8Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a CVE-2021-226547.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose infor CVE-2021-226557.8Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a CVE-2021-226567.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.CVE-2021-226579.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitr CVE-2021-226589.8Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Adm CVE-2021-226598.6Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus pa CVE-2021-22666.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-226607.8CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.CVE-2021-226617.5Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be cha CVE-2021-226627.8A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files,