TI-2021-09210 Aliases CVE-2021-27852 GHSA-xrx4-vq84-23w6

Deserialization of untrusted data in Checkbox Survey

CRITICAL 100Exploited in the wildCWE-502Published 2021-05-27 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.

Why it matters now

Exploitation Active In CISA KEV since 2022-04-11CISA due date 2022-05-02

EPSS 0.30258 98th percentileScored 2026-11-07

Fix Fixed Survey (Checkbox): 7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Checkbox	Survey	before 7	7	Patch available	CNA

Survey VendorCheckbox Affected before 7 Fixed in 7 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:checkbox:survey::::::::	before 7.0	Vulnerable	Checkbox

cpe:2.3:a:checkbox:survey:*:*:*:*:*:*:*:* Versions before 7.0 Vulnerable ·Checkbox

Remediation

Fix · CNA Survey (Checkbox) Fixed in 7

Timeline

2022-04-11 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2021-27852
2026-10-03 Alias added: GHSA-xrx4-vq84-23w6

References

Advisory 1

https://www.kb.cert.org/vuls/id/706695

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences