CVE-2021-33214

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cdn.hms-networks.com/docs/librariesprovider6/cybersecurity/hms-security-advisory-2021-07-09-001---ewon-ecatcher.pdf?sfvrsn=b37418d7_4Vendor Advisory
https://labs.bishopfox.com/advisoriesThird Party Advisory
https://labs.bishopfox.com/advisories/ecatcher-desktop-version-6.6.4Exploit, Third Party Advisory
https://www.ewon.biz/about-us/securityVendor Advisory
https://www.ewon.biz/technical-support/pages/talk2m/talk2m-tools/talk2m-ecatcherVendor Advisory
https://cdn.hms-networks.com/docs/librariesprovider6/cybersecurity/hms-security-advisory-2021-07-09-001---ewon-ecatcher.pdf?sfvrsn=b37418d7_4Vendor Advisory
https://labs.bishopfox.com/advisoriesThird Party Advisory
https://labs.bishopfox.com/advisories/ecatcher-desktop-version-6.6.4Exploit, Third Party Advisory
https://www.ewon.biz/about-us/securityVendor Advisory
https://www.ewon.biz/technical-support/pages/talk2m/talk2m-tools/talk2m-ecatcherVendor Advisory

Timeline

Published: Jul 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-332154.3An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal.CVE-2021-332169.8An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a CVE-2021-332178.8An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by a CVE-2021-332189.8An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell acc CVE-2021-332199.8An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords CVE-2021-33226.5Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions >= >=2.4.0 contain NULL Pointer Dereference (CWE-4 CVE-2021-332207.8An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist.CVE-2021-332219.8An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints.CVE-2021-332238.8An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php fil CVE-2021-332249.8File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and a CVE-2021-332269.8Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/mo CVE-2021-33239.8Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions >= >=2.4.0 contain Integer Underflow (Wrap or Wraparound)