CVE-2021-37207

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns improper access rights to a specific folder containing configuration files. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
SiemensSENTRON powermanager V3All versions

References

Timeline

Published
Nov 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-372089.6A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,CVE-2021-372096.7A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All vCVE-2021-37215.5A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local accCVE-2021-372115.4The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerabiCVE-2021-372125.4The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, CVE-2021-372134.3The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general useCVE-2021-372148.8The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a generalCVE-2021-372154.3The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a geneCVE-2021-372166.1QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in anCVE-2021-372188.8HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access serverCVE-2021-372198.8HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to acceCVE-2021-37225.0A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be w
CVE-2021-37207: High severity, CVSS 7.8 | Vulnix