Security readout for executives and security teams
Plain-English summary
ZOLL Defibrillator Dashboard before version 2.2 could let a low-privilege user place malicious script content where higher-privilege users may execute it in the web application. The business concern is unauthorized actions or data exposure through trusted administrator sessions, but the provided sources do not give severity scoring or exploitation evidence.
Executive priority
Treat this as a targeted remediation item for healthcare or operational environments using the ZOLL dashboard. Prioritize if the application is accessible to many users or if administrators regularly use it. Severity is uncertain from the provided sources, so confirm vendor guidance promptly.
Technical view
This is a CWE-79 cross-site scripting issue in ZOLL Defibrillator Dashboard versions prior to 2.2. The source description says low-privilege users can inject parameters containing malicious scripts that execute for higher-privilege users. The sources do not clarify whether the flaw is stored, reflected, authenticated-only, or tied to specific parameters.
Likely exposure
Exposure is most likely limited to organizations running ZOLL Defibrillator Dashboard earlier than 2.2, especially where low-privilege users can access the dashboard and higher-privilege users administer it through the same web application.
Exploitation context
The provided bundle does not show CISA KEV listing, active exploitation, public exploit availability, or CVSS scoring. Risk depends heavily on whether the dashboard is reachable by untrusted users and whether higher-privilege users interact with injected content.
Researcher notes
Evidence supports authenticated low-privilege script injection impacting higher-privilege users. The source bundle lacks CVSS, parameter details, attack vector specifics, and confirmed exploit status. Avoid assuming unauthenticated reachability or a particular XSS subtype without the full vendor advisory or product testing.
Mitigation direction
- Inventory ZOLL Defibrillator Dashboard deployments and record exact versions.
- Upgrade affected deployments to version 2.2 or later if vendor guidance confirms remediation.
- Review the CISA ICS advisory and ZOLL guidance for supported update steps.
- Restrict dashboard access to trusted users and networks until remediation is complete.
- Review role assignments and remove unnecessary low-privilege application access.
Validation and detection
- Confirm no deployed ZOLL Defibrillator Dashboard instance is earlier than version 2.2.
- Verify only authorized users can authenticate to the dashboard.
- Review application logs for suspicious script-like input in user-controlled parameters.
- Check whether privileged users recently interacted with untrusted dashboard content.
- Document remediation status for each affected deployment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-27479 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://us-cert.cisa.gov/ics/advisories/icsma-21-161-01CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.