CVE-2021-36356
CVE-2021-36356
Vexday Risk Score
72High priority
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 54.4%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
31 Aug 2021Published on NVD
07 Apr 2022Public PoC
Weaponization speed
219 daysto first PoC
Recommendation: Patch as soon as possible — active exploitation confirmed.
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.
Affected products
n/a · n/apublic PoCs found — 3
cve_referencepacketstormsecurity.com/files/166623/Kramer-VIAware-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50856unverifiedvulncheckvulncheck.com/xdb/ef662e12bf64unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.