Deserialization of Untrusted Data in Orion Virtual Infrastructure Monitor - CVE-2021-27277
Published: March 31, 2021
Vulnerability identifier: #VU51827
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-27277
CWE-ID: CWE-502
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insecure input validation when processing serialized data in the OneTimeJobSchedulerEventsService WCF service. A local user can pass specially crafted data to the application and execute arbitrary code on the target system with elevated privileges.
Affected software
Orion Virtual Infrastructure Monitor
How to mitigate CVE-2021-27277
Install updates from vendor's website.
Orion Virtual Infrastructure Monitor - update to 2020.2.5