First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2021-26607

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
TOBESOFT	NEXACRO17	>= 17.1.3.301, <= 17.1.3.301

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36289Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36289Third Party Advisory

Timeline

Published: Oct 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266089.8An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issu CVE-2021-266097.5A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type pa CVE-2021-266108.8The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulne CVE-2021-266119.8HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(r CVE-2021-266129.8An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy CVE-2021-266137.5improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.CVE-2021-266149.8ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable we CVE-2021-266158.8ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an int CVE-2021-266169.8An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.CVE-2021-266179.8This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to exe CVE-2021-266189.8An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerabilit CVE-2021-266199.1An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerabilit