CVE-2021- 42110

CVE-2021- 42110

by Excellium SA

Abstract Advisory Information

The FTP module, which is not installed by default, is prone to a DLL hijacking attack allowing a standard user account to execute command with the highest privileges as NT AUTHORITYSYSTEM

Author: Dominique Righetto


Version affected

Name: Allegro Windows
Versions: 3.3.4152.0 and under


Common Vulnerability Scoring System





Allegro Windows version 3.3.4156.1




Vulnerability Disclosure Timeline

  • 19/08/2021: Vulnerability discovery
  • 19/08/2021: Vulnerability Report to CERT-XLM
  • 08/10/2021: Vulnerability Report to Vendor
  • 13/10/2021: Call with the vendor to clarify fix solutions + given PoC video
  • 08/10/2021: Request CVE IDs to Mitre
  • 08/10/2021: CVE IDs assigned Use CVE-2021-42110
  • 12/10/2021: Call with the vendor to discuss the possible fix solutions
  • 29/11/2021: Expected Vulnerability disclosure

Find more vulnerabilities in our Security Advisory section.