CVE-2021-22669

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allow a low-privileged user to update an administrator’s password and login as an administrator to escalate privileges on the system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-22678.1Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: User Interface). Supported versions that are a CVE-2021-226707.8An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, al CVE-2021-226719.8Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely execute code on the Simpl CVE-2021-226727.8Delta Electronics' CNCSoft ScreenEditor in versions prior to v1.01.30 could allow the corruption of data, a denial-of-service condition, or CVE-2021-226738.0The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from the CDN server, which CVE-2021-226746.5The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and dire CVE-2021-226757.2The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attack CVE-2021-226766.1UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScr CVE-2021-226777.8An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-serv CVE-2021-226787.8Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory CVE-2021-226799.8The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute cod CVE-2021-22688.1Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Courseware). Supported versions that are affected are 12.