Security readout for executives and security teams
Plain-English summary
CVE-2021-32961 lets an unauthenticated network user abuse MDT AutoSave file handling so the server may unpack attacker-controlled content and place a Windows executable where AutoSave may run it. For industrial environments, the business concern is unauthorized change or code execution on systems tied to automation management.
Executive priority
Treat this as a high-priority OT software remediation item, especially if AutoSave is reachable beyond a tightly controlled engineering network. The issue can affect integrity of automation management systems, but provided sources do not establish active exploitation.
Technical view
The flaw is CWE-434 unrestricted upload of a dangerous file type in the AutoSave getfile function. An optional parameter can trigger special request processing, including unzip behavior, enabling placement of a malicious .exe in a searched execution location. The CVSS 3.1 score is 7.5 with network, low-complexity, no-authentication characteristics.
Likely exposure
Organizations using MDT AutoSave before v6.02.06, including listed MDT AutoSave 7.00 and A4SP 5.00 entries, should assume potential exposure where the affected service is reachable over a network. Exposure is more serious if engineering or OT management systems are accessible from untrusted networks.
Exploitation context
The provided bundle does not show CISA KEV listing or confirmed active exploitation. The CVSS vector indicates remote, unauthenticated exploitation is plausible, but the sources provided do not prove exploitation in the wild or public weaponization.
Researcher notes
Evidence is limited to the CVE description, CVSS, affected product entries, CWE-434 classification, and the CISA ICS advisory reference. Avoid assuming additional affected versions, exploit availability, or vendor-specific mitigations beyond v6.02.06 guidance implied by the affected range.
Mitigation direction
- Upgrade affected MDT AutoSave deployments to v6.02.06 or later where applicable.
- Check MDT Software and CISA guidance before applying compensating controls.
- Restrict network access to AutoSave services to trusted management hosts.
- Segment OT and engineering systems from corporate and internet-facing networks.
- Review file handling locations for unexpected executable files.
Validation and detection
- Inventory MDT AutoSave and A4SP versions across engineering environments.
- Confirm whether each instance is older than v6.02.06.
- Map network paths that can reach affected AutoSave services.
- Review logs and monitored directories for unexpected archive or executable activity.
- Verify access controls after remediation or segmentation changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32961 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.