CVE-2021-40846

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Mar 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-408478.1The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code executio CVE-2021-408487.8In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interp CVE-2021-408499.8In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited a CVE-2021-408509.8TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx.CVE-2021-408517.5TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of th CVE-2021-408526.1TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by CVE-2021-408537.2TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerabi CVE-2021-408547.8AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to lau CVE-2021-408559.8The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key cert CVE-2021-408567.5Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.CVE-2021-408578.8Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.CVE-2021-408584.9Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileN