← Database

CVE-2021-36356

CRITICAL CVSS: 9.8 Published: 2021-08-31 Modified: 2026-06-17

Description

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.

Affected Platforms

Kramerav Viaware

Weakness Type

CWE-434

References