LiveActive security incident?Get immediate response
CVE Record

CVE-2021-26471: Unauthenticated remote command execution in Vembu products

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This flaw lets an unauthenticated remote attacker run operating-system commands on affected Vembu backup and disaster recovery products. Because these systems may hold or control backup data, compromise could affect confidentiality, integrity, and recovery capability.

Executive priority

Treat this as urgent if Vembu backup infrastructure is present. The issue can allow full system compromise without credentials, and backup platforms are high-value operational targets.

Technical view

CVE-2021-26471 affects VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1. The HTTP API at /sgwebservice_o.php accepts a command argument that can allow unauthenticated arbitrary shell command execution. CVSS 3.1 is 9.8.

Likely exposure

Organizations running VembuBDR or VembuOffsiteDR versions earlier than 4.2.0.1, especially where the web API is reachable over a network, are the likely exposure group.

Exploitation context

The CVE describes network-reachable, low-complexity, unauthenticated command execution with no user interaction. The provided bundle does not show CISA KEV listing or confirm active exploitation.

Researcher notes

Evidence is strong for affected products, versions, endpoint, and impact from the CVE description and CSIRT references. Evidence in the supplied bundle is insufficient to claim active exploitation, public exploit maturity, or additional affected products.

Mitigation direction

  • Upgrade VembuBDR and VembuOffsiteDR to 4.2.0.1 or later per vendor guidance.
  • Identify and prioritize internet-reachable Vembu backup or offsite disaster recovery servers.
  • Restrict network access to Vembu administrative and web API surfaces.
  • Review vendor and CSIRT guidance for any product-specific hardening or incident response steps.

Validation and detection

  • Inventory VembuBDR and VembuOffsiteDR deployments and record versions.
  • Confirm no exposed instance is running a version earlier than 4.2.0.1.
  • Check external attack surface records for reachable Vembu web services.
  • Review logs around /sgwebservice_o.php for suspicious unauthenticated access patterns.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-26471 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2021-26471Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.