High severity8.8NVD Advisory· Published Jul 25, 2021· Updated Jun 17, 2026
CVE-2021-37444
CVE-2021-37444
Description
NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:nchsoftware:ivm_attendant:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nchsoftware:ivm_attendant:*:*:*:*:*:*:*:*range: <=5.12
- (no CPE)range: <=5.12
- NCH/IVM Attendantdescription
Patches
Vulnerability mechanics
References
2- github.com/0xfml/poc/blob/main/NCH/IVM_5.12_RCE.mdnvdThird Party Advisory
- www.nch.com.au/ivm/index.htmlnvdProduct
News mentions
0No linked articles in our index yet.