TI-2021-03850 Aliases CVE-2021-20623 GHSA-5j8m-48h4-jvjw

Cleartext transmission of sensitive information in Panasonic Video Insight VMS

MEDIUM 47CWE-319Published 2021-02-05 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted request.

Why it matters now

EPSS 0.02937 87th percentileScored 2026-11-07

Fix Fixed Video Insight VMS (Panasonic Corporation): 7.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Panasonic	Video Insight VMS	before 7.8	7.8	Patch available	CNA

Video Insight VMS VendorPanasonic Affected before 7.8 Fixed in 7.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:panasonic:video_insight_vms::::::::	before 7.8	Vulnerable	Panasonic

cpe:2.3:a:panasonic:video_insight_vms:*:*:*:*:*:*:*:* Versions before 7.8 Vulnerable ·Panasonic

Remediation

Fix · CNA Video Insight VMS (Panasonic Corporation) Fixed in 7.8

Timeline

2026-10-02 Threatist record created from CVE-2021-20623
2026-10-03 Alias added: GHSA-5j8m-48h4-jvjw

References

Advisory 2

TI-2019-04287 Code injection in Panasonic Video Insight VMS CVSS 3.1CRITICAL 9.8
TI-2019-04286 SQL injection in Video Insight VMS 7.3.2.5 and earlier CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences