CVE-2021-32961

MDT AutoSave Unrestricted Upload of File with Dangerous Type

Description

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.

Remediation

Solution:

  • Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows: MDT AutoSave 6.x version: Version 6.02.06 (Released January 2021) MDT AutoSave 7.x version: Version 7.05 (Released December 2020) A4SP 4.x version: Version 4.01 (Released June 2021) A4SP 5.x version: Version 5.01 (Released May 2021) For more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support.

Category

7.5
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.34%
Third-Party Advisory cisa.gov
Affected: MDT Software MDT AutoSave
Affected: MDT Software MDT AutoSave
Affected: MDT Software AutoSave for System Platform (A4SP)
Affected: MDT Software A4SP
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02 mitigation third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2021-32961?
CVE-2021-32961 has been scored as a high severity vulnerability.
How to fix CVE-2021-32961?
To fix CVE-2021-32961: Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows: MDT AutoSave 6.x version: Version 6.02.06 (Released January 2021) MDT AutoSave 7.x version: Version 7.05 (Released December 2020) A4SP 4.x version: Version 4.01 (Released June 2021) A4SP 5.x version: Version 5.01 (Released May 2021) For more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support.
Is CVE-2021-32961 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2021-32961 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-32961?
CVE-2021-32961 affects MDT Software MDT AutoSave, MDT Software MDT AutoSave, MDT Software AutoSave for System Platform (A4SP), MDT Software A4SP.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.