CVE-2021-43978

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-43978
https://excellium-services.com/cert-xlm-advisory/CVE-2021-43978Patch, Third Party Advisory
https://www.allegro.be/Vendor Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2021-43978Patch, Third Party Advisory
https://www.allegro.be/Vendor Advisory

Timeline

Published: Dec 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-439795.3Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data rep CVE-2021-43984.3The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. Thi CVE-2021-439803.7The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long s CVE-2021-439819.8mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system comm CVE-2021-439827.8Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute CVE-2021-439837.8WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files CVE-2021-439849.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary op CVE-2021-439859.8An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization.CVE-2021-439867.0The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission CVE-2021-439879.8An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web in CVE-2021-439885.9The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of files to gain unauthor CVE-2021-439897.5mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password h