Command Injection in Sharp NEC Display Solutions products - CVE-2021-20698

Vulnerability identifier: #VU56693

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20698

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

P754Q
UX552S
V404
UX552
P554
V864Q
P484
C861Q
P404
V484
V554Q
V754Q
C651Q
C751Q
V654Q
V984Q
P654Q
C981Q
V554-T
UN462A
UN462VA
C431
UN492S
C551
UN492VS
C501
UN552A
UN552S
V484-T
UN552VS
V404-T
UN552
V554
UN552V

Install updates from vendor's website.

• https://www.sharp-nec-displays.com/global/support/info/A5-1_vulnerability.html
• http://jvn.jp/en/jp/JVN42866574/index.html
• https://www.sharp-nec-displays.com/dl/en/dp_soft/pd_fm_update/index.html

• Multiple vulnerabilities in Sharp NEC Display Solutions public displays