CVE-2021-26639: WISA Smart Wing CMS File Download Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-17 · updated 2026-06-17
Weakness: CWE-20

Description

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system.

Affected products

WISA corp. Smart Wing CMS: before r18715.20211229 — fixed in r18715.20211229

How to fix

Upgrade to a fixed version: WISA corp. Smart Wing CMS r18715.20211229. Check the vendor advisory for mitigations.

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66875
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66875

Get alerted when CVE-2021-26639 or the next vulnerability affects your stack