CVE-2021-27852

Checkbox Survey

Published 27 May 2021 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 11 Apr 2022, with a remediation deadline of 2 May 2022 for US federal agencies.

Required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.

Description

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.

References

www.kb.cert.org/vuls/id/706695 · Third Party Advisory, US Government Resource
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27852 · US Government Resource