CVE-2021-44153

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables, as demonstrated by an ISV demo "C:\Windows\System32\calc.exe" entry. An attacker can exploit this to run a malicious binary on startup, or when triggering the Reread/Restart Servers function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2021
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-441547.2An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then CVE-2021-441555.3An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is vali CVE-2021-441588.0ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authentica CVE-2021-441599.84MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshel CVE-2021-44164.3The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing CVE-2021-441607.3Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s pr CVE-2021-441618.8Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in loca CVE-2021-441627.5Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of speci CVE-2021-441636.1Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaS CVE-2021-441649.8Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker CVE-2021-441657.2A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER M CVE-2021-441664.1An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a re