CVE-2021-26622

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-94

Affected software

VendorProductVersions
Genians Co., LtdGenian NAC Suite V4.0>= unspecified, <= 4.0.145.0831
Genians Co., LtdGenian NAC V5.0 & Genian NAC Suite V5.0>= unspecified, <= 5.0.42.0827

References

Timeline

Published
Mar 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-266239.8A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark CVE-2021-266248.8An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid argumentsCVE-2021-266258.8Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerabilitCVE-2021-266268.8Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter valuCVE-2021-266277.5Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remCVE-2021-266286.1Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading fileCVE-2021-266298.8A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file isCVE-2021-266309.8Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vuCVE-2021-266317.5Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploiCVE-2021-266339.8SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerCVE-2021-266349.8SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files CVE-2021-266357.8In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wro
CVE-2021-26622: Critical severity, CVSS 10.0 | Vulnix