CVE-2021-22674

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and directories on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
n/a	WebAccess/SCADA	WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04Patch, Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04Patch, Third Party Advisory, US Government Resource

Timeline

Published: Aug 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-226757.2The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attack CVE-2021-226766.1UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScr CVE-2021-226777.8An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-serv CVE-2021-226787.8Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory CVE-2021-226799.8The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute cod CVE-2021-22688.1Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Courseware). Supported versions that are affected are 12.CVE-2021-226809.8NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memor CVE-2021-226819.8Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix cont CVE-2021-226827.8Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including rea CVE-2021-226837.8Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to cr CVE-2021-226847.5Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper memory assignment can le CVE-2021-226857.5An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1.