title: Remote code execution in Valmet DNA before Collection 2021
description: A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.
problem types: CWE-305 Authentication Bypass by Primary Weakness
affected:
{
product: Valmet DNA
vendor: Valmet DNA
versions:
lessThan: Collection 2021, status: affected, version: Collection 2012, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Upgrade to Valmet DNA version Collection 2021
workarounds: Use Valmet DNA Firewall feature to limit access to TCP port 1517