Checkbox · Checkbox Survey

CVE-2021-27852

Checkbox Survey Deserialization of Untrusted Data Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 30%

What it is

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.

CISA: Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.

What to do

Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.

Deadline for US federal agencies: May 2, 2022

Added to the CISA list: April 11, 2022
Published: May 27, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 30% in the top 1.8% of all known vulnerabilities
Weakness: CWE-502
More details: NVD · CVE.org · CISA

All references (1)

https://www.kb.cert.org/vuls/id/706695

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.