CVE-2021-26639
Published: 17 August 2022
Summary
CVE-2021-26639 is a high-severity Improper Input Validation (CWE-20) vulnerability in Wisa Smart Wing Cms. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 30.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-13433
Vulnerability details
This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policies can require integrity verification of software prior to installation, reducing risks from unverified downloads.
Blocks installation of components lacking a valid signature, mitigating download or installation of code without integrity checks.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Acquisition and maintenance portions of the strategy drive requirements for integrity verification of downloaded or supplied code.
Mandating integrity control and approved-only changes during development prevents incorporation of code or components lacking integrity validation.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Supply chain protection requires integrity verification of acquired components, directly reducing insertion or tampering of malicious code during delivery.
Reduces exposure to code obtained without integrity verification by requiring assurance processes that confirm authenticity and absence of tampering.