CVE-2021-45421

HighCVSS 7.5

Published: 14/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.26%

66th percentile - higher than 66% of all known CVEs

Summary

Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can exploit this misconfiguration to access all files in remote directories.

Risk Assessment

The risk involves potential leakage of sensitive data such as configurations or operational data, which could lead to further attacks on the infrastructure.

Recommendation

It is recommended to immediately remove or replace Emerson Dixell XWEB-500 products, as they have not been supported since 2018 and do not receive security patches.

Other vulnerabilities in Emerson Dixell XWEB-500

CVE-2021-45420Critical
Emerson Dixell XWEB-500 products are vulnerable to arbitrary file write in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An unauthenticated attacker can write any file on the target system, leading to denial of service and potentially remote code execution.

Original NVD description (English source)

Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced.