CVEvulnerability

CVE-2021-26608

9.8 CRITICAL Published 2021-09-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-09-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-345, CWE-353

Description

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash.

Affected configurations

• handysoft hshell 1.7.4.5 • handysoft hshell 2.0.3.5 • handysoft hshell 4.0.1.6

Related

Weakness · CWE (2)

  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-353 Missing Support for Integrity Check weakness

References