Distributed Data Systems WebHM
Priority HIGH 69CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.
Why it matters now
EPSS 0.35804 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WebHMI (Distributed Data Systems): 4.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Distributed Data Systems | WebHMI | 4.1 to before 4.1 | 4.1 | Patch available | CNA |
- WebHMI VendorDistributed Data Systems Affected 4.1 to before 4.1 Fixed in 4.1 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:webhmi:webhmi_firmware:*:*:*:*:*:*:*:* | before 4.1 | Vulnerable | Distributed Data Systems |
| cpe:2.3:h:webhmi:webhmi:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Distributed Data Systems |
- cpe:2.3:o:webhmi:webhmi_firmware:*:*:*:*:*:*:*:* Versions before 4.1 Vulnerable ·Distributed Data Systems
- cpe:2.3:h:webhmi:webhmi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Distributed Data Systems
Remediation
- Fix · CNA WebHMI (Distributed Data Systems) Fixed in 4.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Distributed Data Systems WebHMI 4.1
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2021-19693 Distributed Data Systems WebHMPriority MEDIUM 45
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43936
- 2026-10-03 Alias added: GHSA-9558-55mx-wf4p
References
More Distributed Data Systems Webhmi Firmware vulnerabilities
- TI-2021-19693 Distributed Data Systems WebHM CVSS 3.1CRITICAL 9.8
- TI-2022-02078 Distributed Data Systems WebHMI OS Command Injection CVSS 3.1CRITICAL 9.1
- TI-2022-02079 Distributed Data Systems WebHMI Cross-site Scripting CVSS 3.1MEDIUM 6.2
Sources
- CVE-2021-43936 · CVE Program
- CVE-2021-43936 · NVD
- FIRST EPSS
- GHSA-9558-55mx-wf4p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences