{"id":"CVE-2021-27852","published":"2021-05-27T21:15:20Z","modified":"2026-06-17T03:45:31Z","title":"Checkbox Survey Deserialization of Untrusted Data Vulnerability","vendor":"Checkbox","product":"Checkbox Survey","tier":"core","eol":null,"description":{"text":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a deserialization of untrusted data vulnerability in the CheckboxWeb.dll component of Checkbox Survey. An unauthenticated remote attacker can exploit it to execute arbitrary code, with no user interaction required and the issue affecting versions prior to 7.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:07Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.30258,"percentile":0.98223,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-04-11","dueDate":"2022-05-02","ransomware":false,"requiredAction":"Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-27852","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-04-11","exploitedFirstSeen":"2022-04-11","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-11"},{"url":"https://cisa.gov/news-events/alerts/2022/04/27/2021-top-routinely-exploited-vulnerabilities","date":"2022-04-28"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-117a","date":"2022-04-28"},{"url":"https://www.group-ib.com/resources/research-hub/hi-tech-crime-trends-2022/","date":"2023-01-17"},{"url":"https://rt-solar.ru/solar-4rays/blog/4329/","date":"2024-05-17"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.kb.cert.org/vuls/id/706695","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.kb.cert.org/vuls/id/706695","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27852","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote attacker exploits public-facing web component","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows an unauthenticated remote attacker to execute arbitrary code","start":86,"end":153}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Deserialization yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows an unauthenticated remote attacker to execute arbitrary code","start":86,"end":153}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-14590","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14590","exploited":true,"exploitedSince":"2022-04-11","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-05-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27852","provenance":"source"},{"date":"2022-04-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-04-11","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14590","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":319},"priority":{"score":61.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1665 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.64,"detail":"percentile 0.9822"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}