Medium severity · published Jul 9, 2021
CVE-2021-33214
In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of…
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Ecatcher · Hms-networks
through 6.6.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33214
Vendor Advisory
https://cdn.hms-networks.com/docs/librariesprovider6/cybersecurity/hms-security-advisory-2021-07-09-001---ewon-ecatcher.pdf?sfvrsn=b37418d7_4
Third Party Advisory
https://labs.bishopfox.com/advisories
Exploit
https://labs.bishopfox.com/advisories/ecatcher-desktop-version-6.6.4
Vendor Advisory
https://www.ewon.biz/about-us/security
Vendor Advisory
https://www.ewon.biz/technical-support/pages/talk2m/talk2m-tools/talk2m-ecatcher
More from Ecatcher
10.0
CVE-2020-14498
HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code