CVE-2021-27184
Last modified
CVE-2021-27184 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file (in a %APPDATA%\Pelco directory) when DSControlPoint.exe is executed.. EPSS estimates a 1.59% chance of exploitation in the next 30 days.
Description
Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file (in a %APPDATA%\Pelco directory) when DSControlPoint.exe is executed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pelco | Digital Sentry Server | 7.18.72.11464 |
References
- https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server.txtExploit, Third Party Advisory
- https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-historyRelease Notes, Vendor Advisory
- https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server.txtExploit, Third Party Advisory
- https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-historyRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-27184?
How severe is CVE-2021-27184?
How do I fix CVE-2021-27184?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-27178An issue was discovered on FiberHome HG6245D devices through…7.5
- CVE-2021-27179An issue was discovered on FiberHome HG6245D devices through…7.5
- CVE-2021-27180An issue was discovered in MDaemon before 20.0.4. There is R…6.1
- CVE-2021-27181An issue was discovered in MDaemon before 20.0.4. Remote Adm…8.8
- CVE-2021-27182An issue was discovered in MDaemon before 20.0.4. There is a…8.8
- CVE-2021-27183An issue was discovered in MDaemon before 20.0.4. Administra…7.2
- CVE-2021-27185The samba-client package before 4.0.0 for Node.js allows com…9.8
- CVE-2021-27186Fluent Bit 1.6.10 has a NULL pointer dereference when an flb…7.5
- CVE-2021-27187The Sovremennye Delovye Tekhnologii FX Aggregator terminal c…7.5
- CVE-2021-27188The Sovremennye Delovye Tekhnologii FX Aggregator terminal c…7.5
- CVE-2021-27189The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL…5.9
- CVE-2021-27190A Stored Cross Site Scripting(XSS) Vulnerability was discove…5.4
Are you affected by CVE-2021-27184?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST