CVE-2021-26625

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation logic to download and execute arbitrary malicious file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266268.8Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter valu CVE-2021-266277.5Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to rem CVE-2021-266286.1Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file CVE-2021-266298.8A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is CVE-2021-266309.8Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vu CVE-2021-266317.5Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploi CVE-2021-266339.8SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulner CVE-2021-266349.8SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files CVE-2021-266357.8In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wro CVE-2021-266369.6Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure a CVE-2021-266379.8There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so una CVE-2021-266389.8Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remo