QID 375741

Date Published: 2021-08-02

QID 375741: PowerShell Remote Code Execution Vulnerability

PowerShell Core is a cross-platform automation and configuration tool/framework that works well with your existing tools and is optimized for dealing with structured data, REST APIs, and object models.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

Affected Versions:
PowerShell Version 7.0 Prior to 7.0.6
PowerShell Version 7.1 Prior to 7.1.3

QID Detection Logic: (Authenticated)
Operating System: Windows
The QID checks for vulnerable version of file pwsh.exe and QID checks for vulnerable version of PowerShell Core by running command pwsh --version on linux systems.


NOTE: The Windows check will only work for msi installations.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the target system.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
    • Solution
    Customers are advised to install the latest version of PowerShell Core which can be in the Releases page
    Vendor References

    CVEs related to QID 375741

    CVE-2021-26701 |
    Software Advisories
    Advisory ID Software Component Link
    CVE-2021-26701 URL Logo github.com/PowerShell/Announcements/issues/23
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].