{"id":"CVE-2021-27852","aliases":["EUVD-2021-14590","GHSA-xrx4-vq84-23w6"],"status":"published","title":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an...","description":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.30258,"percentile":0.98247,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2021-05-27T20:55:11Z","modified":"2026-06-17T03:45:31Z","kev":{"date_added":"2022-04-11","due_date":"2022-05-02","required_action":"Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-04-11"},{"source":"kev","since":"2022-04-11"}],"products":[{"vendor":"checkbox","product":"checkbox survey"},{"vendor":"checkbox","product":"survey"}],"references":[{"url":"https://www.kb.cert.org/vuls/id/706695","tags":["x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27852","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27852"},{"url":"https://github.com/advisories/GHSA-xrx4-vq84-23w6"}],"sources":{"cve":[{"id":"CVE-2021-27852","description":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.","status":"published","published":"2021-05-27T20:55:11Z","modified":"2025-10-21T23:25:44.136Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:33:04.679189Z"}],"euvd":[{"id":"EUVD-2021-14590","description":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.","status":"published","published":"2021-05-27T20:55:11Z","modified":"2025-10-21T23:25:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-04-11","updated_at":"2026-11-02T20:31:25.308373Z"}],"ghsa":[{"id":"GHSA-xrx4-vq84-23w6","title":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an...","description":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.","status":"published","published":"2022-05-24T19:03:34Z","modified":"2025-10-22T00:32:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:04:04.786232Z"}],"kev":[{"id":"CVE-2021-27852","title":"Checkbox Survey Deserialization of Untrusted Data Vulnerability","description":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.","cwes":["CWE-502"],"kev":{"date_added":"2022-04-11","due_date":"2022-05-02","required_action":"Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2021-27852","description":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.","status":"published","published":"2021-05-27T21:15:20.567Z","modified":"2026-06-17T03:45:31.033Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:53.987491Z"}]}}