Live › vulnerability › CVE-2021-27852
Go to dashboardCheckbox Survey's CheckboxWeb.dll deserializes untrusted data, so a remote request can trigger it. An unauthenticated attacker can execute arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Checkbox Checkbox Survey | vendor | – | – |
Find the Checkbox Survey install and check the version; versions 6 and earlier are end-of-life and in scope.
Upgrade to Checkbox Survey 7 or later, or remove version 6 and earlier from the network.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
CISA required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
This page as .md · .json · in your agent: get_signal("CVE-2021-27852")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.