CVE-2021-32933
📋 TL;DR
This vulnerability allows attackers to upload malicious files through an API in MDT AutoSave software, which can manipulate process creation commands to execute arbitrary code. It affects MDT AutoSave versions before 6.02.06. Industrial control systems using this software are at risk.
💻 Affected Systems
- MDT AutoSave
📦 What is this software?
Autosave by Auvesy Mdt
Autosave by Auvesy Mdt
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with system privileges, potentially disrupting industrial processes or exfiltrating sensitive data.
Likely Case
Remote code execution leading to malware deployment, data theft, or system manipulation in industrial environments.
If Mitigated
Limited impact if proper network segmentation and access controls prevent API access from untrusted networks.
🎯 Exploit Status
The vulnerability involves simple file upload and command injection, making exploitation relatively straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v6.02.06 and later
Vendor Advisory: https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02
Restart Required: Yes
Instructions:
1. Download MDT AutoSave version 6.02.06 or later from the vendor. 2. Backup current configuration and data. 3. Install the update following vendor instructions. 4. Restart the system to apply changes.
🔧 Temporary Workarounds
Network Segmentation
allIsolate MDT AutoSave systems from untrusted networks and restrict API access.
Access Control
windowsImplement strict firewall rules to limit access to MDT AutoSave API endpoints.
netsh advfirewall firewall add rule name="Block MDT API" dir=in action=block protocol=TCP localport=<API_PORT>
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from untrusted networks.
- Deploy application whitelisting to prevent execution of unauthorized processes.
🔍 How to Verify
Check if Vulnerable:
Check MDT AutoSave version in the software interface or installation directory. Versions below 6.02.06 are vulnerable.Check Version:
Check the 'About' section in MDT AutoSave GUI or examine installed programs in Windows Control Panel.Verify Fix Applied:
Confirm version is 6.02.06 or higher in the software interface and test API functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads via MDT AutoSave API
- Unexpected process creation events
- Command line arguments containing suspicious patterns
Network Indicators:
- Unusual traffic to MDT AutoSave API endpoints
- File uploads to industrial control system components
SIEM Query:
source="MDT AutoSave" AND (event="file_upload" OR event="process_creation") AND command_line="*cmd*" OR command_line="*powershell*"