High severity · published May 13, 2021
CVE-2021-22153
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker…
7.3
CVSS
1%
EPSS
No
On KEV
Description
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with the authority of the user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unified Endpoint Management · Blackberry
through 12.12.0; 12.12.1a; 12.12.1a; 12.12.1a; 12.12.1a; 12.12.1a; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22153
Vendor Advisory
https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
More from Unified Endpoint Management
7.5
CVE-2019-8999
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any…
5.5
CVE-2021-22152
A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and…
5.3
CVE-2021-22154
An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an…