What’s Vulnerable › Vulnerabilities

CVE-2021-26473: Unauthenticated arbitrary file upload and command execution in Vembu products

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-08 · updated 2026-06-17
• Weakness: CWE-434

Description

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.

Affected products

• Vembu Bdr Suite: before 4.2.0.1 — fixed in 4.2.0.1
• Vembu Offsite Dr: before 4.2.0.1 — fixed in 4.2.0.1

How to fix

Upgrade to a fixed version: Vembu Bdr Suite 4.2.0.1; Vembu Offsite Dr 4.2.0.1. Check the vendor advisory for mitigations.

References

• https://csirt.divd.nl/2021/05/11/Vembu-zero-days/
• https://csirt.divd.nl/cases/DIVD-2020-00011/
• https://csirt.divd.nl/cves/CVE-2021-26473/
• https://www.wbsec.nl/vembu
• https://csirt.divd.nl/2021/05/11/Vembu-zero-days/
• https://csirt.divd.nl/cases/DIVD-2020-00011/
• https://csirt.divd.nl/cves/CVE-2021-26473/
• https://www.wbsec.nl/vembu

Get alerted when CVE-2021-26473 or the next vulnerability affects your stack