CVE-2021-35064

What it actually does

KramerAV VIAWare systems contain an unsafe sudoers configuration that permits execution of dangerous administrative commands such as unzip, systemctl, and dpkg with elevated privileges. An attacker who can reach and interact with the vulnerable system can abuse those permitted commands to escalate to root-level control, modify installed packages or services, overwrite privileged files, start or replace system services, and gain full confidentiality, integrity, and availability impact on the appliance.

Why it matters to the business

Successful exploitation can give an attacker complete control of a VIAWare collaboration system, allowing disruption of meeting-room services, tampering with device configuration, persistence on the appliance, and potential use of the system as a foothold into adjacent networks. The high CVSS score, high EPSS probability, and weaponized exploit maturity make this a priority issue even though it is not currently listed in CISA KEV or known ransomware use.

How an attack unfolds

An attacker identifies a KramerAV VIAWare instance and gains a way to execute commands in the appliance context exposed by the vulnerable product. Because the sudoers policy allows risky commands to run with elevated privileges, the attacker invokes sudo with permitted utilities such as unzip, systemctl, or dpkg. These utilities can be abused to write or unpack files into privileged locations, install or replace packages, create or modify services, and execute attacker-controlled code as root. After privilege escalation, the attacker may establish persistence by adding services or modifying startup behavior, collect configuration and credentials available on the appliance, disable services, or use the compromised device to pivot further into the network.

How to fix it

Upgrade KramerAV VIAWare to a vendor-supported release that corrects the sudoers misconfiguration if available from KramerAV support. Because no fixed version was provided in the input, organizations should contact the vendor, review current security advisories, and avoid running unsupported VIAWare builds. As interim mitigation, restrict network access to VIAWare management and collaboration interfaces to trusted administrative networks, remove unnecessary internet exposure, enforce strong authentication, and harden the host sudoers configuration so unprivileged application accounts cannot run unzip, systemctl, dpkg, package managers, shells, interpreters, or file-writing utilities via sudo. Monitor and review any local changes carefully, because manual sudoers edits can affect product supportability and system stability.

How to confirm the fix worked

Confirm the installed VIAWare version against the latest vendor-supported release and advisory guidance. On the appliance, review sudo policy using sudo -l for application or service accounts and inspect /etc/sudoers and /etc/sudoers.d/* for entries allowing NOPASSWD or broad execution of unzip, systemctl, dpkg, package managers, shells, interpreters, or wildcard command paths. Validate that non-administrative product users cannot run these commands through sudo. From an exposure perspective, confirm that VIAWare interfaces are not publicly reachable unless explicitly required and that administrative access is restricted. After remediation, retest privilege boundaries and verify that attempts to invoke the dangerous commands through sudo are denied and logged.

Typical attack path

1. Discover an exposed or reachable KramerAV VIAWare system.
2. Obtain command execution or shell-level interaction with the appliance through an exposed interface, chained vulnerability, default credential, or prior foothold.
3. Run sudo -l or otherwise determine that sudoers permits dangerous commands such as unzip, systemctl, or dpkg.
4. Abuse an allowed command to write files, install packages, modify services, or execute code with root privileges.
5. Create persistence, such as a modified systemd service, new package, scheduled task, or replacement binary.
6. Collect sensitive configuration data, disrupt device operation, or pivot from the appliance to other reachable systems.

How to detect it

Look for evidence of privilege escalation and post-exploitation activity on VIAWare appliances. Useful sources include /var/log/auth.log, /var/log/secure, sudo logs, systemd journal logs, package manager logs, shell history, web/application logs, and file integrity monitoring records. Search for sudo executions of unzip, systemctl, dpkg, package-management tools, shells, interpreters, or commands writing into privileged directories. Review systemd logs for new, enabled, restarted, or modified services around suspicious login or application activity. Inspect dpkg and apt logs for unexpected package installation or removal. Check for newly created files in /etc/systemd/system/, /lib/systemd/system/, /etc/sudoers.d/, /usr/local/bin/, /tmp/, /var/tmp/, and web-accessible directories. Correlate any suspicious sudo activity with inbound connections to VIAWare services, anomalous authentication events, new outbound connections, or changes to firewall, service, or package state.

• sudo: unzip
• COMMAND=/usr/bin/unzip
• COMMAND=/bin/unzip
• sudo: systemctl
• COMMAND=/bin/systemctl
• COMMAND=/usr/bin/systemctl
• sudo: dpkg
• COMMAND=/usr/bin/dpkg
• COMMAND=/bin/dpkg
• NOPASSWD: /usr/bin/unzip
• NOPASSWD: /bin/unzip
• NOPASSWD: /usr/bin/systemctl
• NOPASSWD: /bin/systemctl
• NOPASSWD: /usr/bin/dpkg
• NOPASSWD: /bin/dpkg
• /etc/sudoers.d/
• /etc/systemd/system/
• /lib/systemd/system/
• systemctl enable
• systemctl start
• systemctl restart
• systemctl daemon-reload
• dpkg -i
• apt install
• /var/log/auth.log
• /var/log/secure
• /var/log/dpkg.log
• /var/log/apt/history.log

What your security team should do

• Treat affected VIAWare systems as high priority due to weaponized exploit maturity, high EPSS, and full system compromise potential.
• Inventory all KramerAV VIAWare appliances and confirm software versions, support status, and network exposure.
• Apply the vendor-supported fixed release or vendor remediation as soon as available; if no fix is available, isolate or retire exposed unsupported systems.
• Restrict access to VIAWare management and collaboration services using firewall rules, VPN, administrative allowlists, and segmentation.
• Audit sudoers configuration for dangerous NOPASSWD or broad command permissions and remove unsafe entries where operationally possible.
• Review historical logs for suspicious sudo use, package installation, service modification, or unexpected systemd changes.
• Hunt for persistence on appliances, including new or modified systemd unit files, unexpected packages, altered startup scripts, and unknown binaries in privileged paths.
• If exploitation is suspected, preserve logs and disk artifacts, rotate credentials stored or used by the appliance, rebuild from trusted media, and investigate adjacent network access.