CVE-2021-36356: Kramerav Viaware

Critical severity, CVSS 9.8. EPSS: 54.4% chance of exploitation in the next 30 days.

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.

Affected products

• Kramerav Viaware: up to and including 2021-08

Published 2021-08-31. Last modified 2026-06-17.