CVE-2021-32089

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbitrary files to the filesystem that can then be accessed through the web interface. This can lead to information disclosure and code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-320909.8The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.CVE-2021-320916.1A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.CVE-2021-320926.1A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remo CVE-2021-320936.5The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files vi CVE-2021-320948.8U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.CVE-2021-320958.1U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.CVE-2021-320968.8The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary R CVE-2021-320989.8Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.CVE-2021-320999.8A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u CVE-2021-32109.6components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands wh CVE-2021-321006.5A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user.CVE-2021-321018.2The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the