CVE-2021-44159: 4MOSAn GCB Doctor - Unrestricted Upload of File

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-20 · updated 2026-06-17
Weakness: CWE-434

Description

4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without authentication and execute arbitrary code in order to perform arbitrary system operations or deny of service attack.

Affected products

4MOSAn GCB Doctor: before 2021-09-16 — fixed in 2021-09-16

How to fix

Upgrade to a fixed version: 4MOSAn GCB Doctor 2021-09-16. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/tw/cp-132-5395-eee40-1.html
https://www.twcert.org.tw/tw/cp-132-5395-eee40-1.html

Get alerted when CVE-2021-44159 or the next vulnerability affects your stack