CVE-2021-45420
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Emerson Dixell XWEB-500 products are vulnerable to arbitrary file write in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An unauthenticated attacker can write any file on the target system, leading to denial of service and potentially remote code execution.
Risk Assessment
The risk includes full system compromise, data loss, and disruption of refrigeration equipment, potentially impacting business continuity.
Recommendation
Immediately decommission or replace Emerson Dixell XWEB-500 devices, as the product has been unsupported since 2018 and will not receive security patches.
Original NVD description (English source)
Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.