CVE-2021-23910

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is an out-of-bounds array access in RemoteDiagnosisApp.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23928.8Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are CVE-2021-239219.1An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements.CVE-2021-239225.4An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webvi CVE-2021-239238.1An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.CVE-2021-239247.5An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.CVE-2021-239256.1An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document CVE-2021-239269.1The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnera CVE-2021-239276.4OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.CVE-2021-239286.1OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.CVE-2021-239296.1OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?CVE-2021-23938.1Vulnerability in the Oracle E-Records product of Oracle E-Business Suite (component: E-signatures). Supported versions that are affected are CVE-2021-239306.1OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.