CVE-2021-32497

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user starts the emulator the executable is run without further checks.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Dec 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-324988.6SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary ex CVE-2021-324997.5SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable CVE-2021-325034.9Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious a CVE-2021-325045.3Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious a CVE-2021-325066.5Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via CVE-2021-325076.5Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary files CVE-2021-325086.5Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files CVE-2021-325096.5Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by CVE-2021-325104.3QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary d CVE-2021-325114.3QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated attackers to list arbitrary direc CVE-2021-325129.8QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and CVE-2021-325139.8QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and e