CVE-2021-32498

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET the corresponding executable will be started instead of the emulator

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-324997.5SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executableCVE-2021-325034.9Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious aCVE-2021-325045.3Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious aCVE-2021-325066.5Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files viaCVE-2021-325076.5Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary filesCVE-2021-325086.5Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files CVE-2021-325096.5Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files byCVE-2021-325104.3QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary dCVE-2021-325114.3QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated attackers to list arbitrary direcCVE-2021-325129.8QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and CVE-2021-325139.8QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and eCVE-2021-325147.5Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the devic
CVE-2021-32498: High severity, CVSS 8.6 | Vulnix