CVE-2021-40376: Otris Update Manager

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000.

Affected products

• Otris Update Manager: version 1.2.1.0 only

Published 2022-03-10. Last modified 2026-06-17.