CVE-2021-22796

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
n/aC-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior)C-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior)

References

Timeline

Published
Feb 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-227977.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious scriCVE-2021-227987.5A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposedCVE-2021-227993.8A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network CVE-2021-22807.1Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is PrioCVE-2021-228007.5A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controlleCVE-2021-228019.8A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configureCVE-2021-228029.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length CVE-2021-228039.8A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number ofCVE-2021-228047.5A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files beCVE-2021-228059.1A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of CVE-2021-228067.5A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when CVE-2021-228077.8A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is l
CVE-2021-22796: High severity, CVSS 7.8 | Vulnix