Actively exploited in the wild
Accellion FTA OS Command Injection Vulnerability
Accellion - FTA · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-27104
CriticalCVSS 9.8KEVSummary
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Risk Assessment
An attacker can remotely execute arbitrary OS commands on the FTA server, leading to full device compromise and potential exfiltration of transferred files. The vulnerability was exploited in real-world large-scale attacks.
Recommendation
Update Accellion FTA to FTA_9_12_380 or later, or preferably migrate to a supported platform since FTA has been discontinued. Review logs for signs of compromise.
Other vulnerabilities in Accellion FTA
See all- CVE-2021-27103CriticalActively exploited
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
- CVE-2021-27101CriticalActively exploited
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
- CVE-2017-8789Critical
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to an SQL injection vector via report_error.php?year='payload.
Original NVD description (English source)
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.