CVE-2021-36356

CRITICAL 9.8CVE-2021-36356 · Published 31/08/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
viaware kramerav	`≤ 2021-08`	No fix yet

Description

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.

References

packetstormsecurity.com/files/166623/Kramer-VIAware-Remote-Code-Execution.html · Exploit
write-up.github.io/kramerav · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free