CVE-2021-26616

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-266179.8This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to exeCVE-2021-266189.8An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerabilitCVE-2021-266199.1An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerabilitCVE-2021-266207.5An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steaCVE-2021-266219.8An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by usCVE-2021-2662210.0An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NACVE-2021-266239.8A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark CVE-2021-266248.8An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid argumentsCVE-2021-266258.8Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerabilitCVE-2021-266268.8Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter valuCVE-2021-266277.5Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remCVE-2021-266286.1Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file
CVE-2021-26616: Critical severity, CVSS 9.8 | Vulnix