CVE-2021-36356

What it actually does

Kramer VIAware through August 2021 contains an unauthenticated remote code execution vulnerability caused by improper input validation in ajaxPages/writeBrowseFilePathAjax.php. The endpoint accepts attacker-controlled executable pathnames, allowing a remote attacker to direct the application to run arbitrary code or commands on the underlying system. The issue stems from an incomplete remediation of an earlier flaw where GUI access to browseSystemFiles.php was removed, but the backend execution pathway remained reachable. With network access to the VIAware web interface, an attacker can compromise confidentiality, integrity, and availability of the host.

Why it matters to the business

Successful exploitation can give an attacker full control of a Kramer VIAware presentation/collaboration system, enabling disruption of meeting room services, tampering with displayed or shared content, theft of files or credentials stored on the device, and use of the system as an internal network foothold. The high CVSS score, weaponized exploit maturity, and elevated EPSS likelihood indicate this should be treated as a high-priority exposure even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an internet-exposed or internally reachable Kramer VIAware instance. They then send a crafted HTTP request directly to ajaxPages/writeBrowseFilePathAjax.php, bypassing the removed GUI path and supplying an arbitrary executable pathname or command-related value accepted by the vulnerable backend logic. Because the endpoint does not properly validate or restrict the executable path, the application invokes attacker-selected code in the context of the VIAware process. After execution, the attacker may establish persistence, run reconnaissance commands, retrieve sensitive files, modify application content, disrupt service, or pivot further into the network depending on host privileges and network reachability.

How to fix it

Upgrade Kramer VIAware to a vendor-supported release that fully addresses CVE-2021-36356 and the incomplete fix lineage from CVE-2019-17124. If an exact fixed version is not available in internal asset records, obtain current firmware/software directly from Kramer support or the official download portal and confirm with the vendor that the release is later than the vulnerable August 2021 builds. Until patched, remove VIAware management and web interfaces from direct internet exposure, restrict access to trusted administrative networks or VPNs, enforce firewall allowlisting, and monitor or block direct requests to ajaxPages/writeBrowseFilePathAjax.php where feasible. If exploitation is suspected, rebuild or reimage affected VIAware systems from trusted media after preserving forensic evidence, rotate any credentials stored on or used by the system, and review adjacent network access.

How to confirm the fix worked

Confirm the deployed VIAware version is a vendor-supported build released after the vulnerable August 2021 versions and verified by Kramer as remediated. Validate that ajaxPages/writeBrowseFilePathAjax.php cannot be used to submit arbitrary executable paths and that requests to the endpoint are rejected, authenticated, or otherwise safely handled. From an exposure perspective, scan external and internal attack surfaces for Kramer VIAware web interfaces and verify they are not publicly reachable unless explicitly required and protected. Review web server and application logs for historical requests to the vulnerable endpoint, especially requests containing path traversal, shell metacharacters, executable paths, or unusual POST parameters.

Typical attack path

1. Discover a Kramer VIAware web interface exposed to the internet or reachable from a compromised network segment.
2. Probe VIAware-specific web paths and version indicators to confirm a vulnerable deployment through August 2021.
3. Send a crafted unauthenticated HTTP request to ajaxPages/writeBrowseFilePathAjax.php with a malicious or attacker-controlled executable pathname.
4. Trigger execution of arbitrary code on the VIAware host.
5. Run post-exploitation commands to enumerate the system, collect files or credentials, and assess network access.
6. Deploy additional tooling, persistence, or use the host as a foothold for lateral movement or service disruption.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF logs, and VIAware application logs for requests to ajaxPages/writeBrowseFilePathAjax.php from untrusted or unexpected IP addresses. Focus on POST requests, repeated probing of ajaxPages paths, and parameters containing absolute paths, relative path traversal, shell metacharacters, or executable names. Check system logs and process execution telemetry, if available, for unusual child processes spawned by the web server or VIAware application, including shells, scripting interpreters, download utilities, or network tools. Inspect the filesystem for recently created files in web-accessible directories, temporary directories, startup locations, or application directories. Network telemetry should be reviewed for outbound connections from VIAware hosts to unfamiliar external IPs, especially immediately after suspicious HTTP requests. Because this flaw has weaponized exploit maturity, treat successful-looking requests to the vulnerable endpoint followed by new processes, file writes, or outbound connections as likely exploitation.

• /ajaxPages/writeBrowseFilePathAjax.php
• ajaxPages/writeBrowseFilePathAjax.php
• writeBrowseFilePathAjax.php
• browseSystemFiles.php
• ../
• ..%2f
• ..%5c
• /bin/sh
• /bin/bash
• cmd.exe
• powershell.exe
• wget
• curl
• nc
• netcat
• ;
• &&
• |

What your security team should do

• Prioritize identification of all Kramer VIAware deployments, especially systems reachable from the internet, guest networks, meeting spaces, or flat internal networks.
• Patch or upgrade all affected VIAware instances to a vendor-confirmed fixed release; if no confirmed fixed version is available, engage Kramer support and apply the latest supported update.
• Immediately restrict network access to VIAware web interfaces using firewall rules, VPN, management VLANs, or allowlisted administrative hosts.
• Create SIEM detections for requests to ajaxPages/writeBrowseFilePathAjax.php, particularly unauthenticated POST requests and parameters containing executable paths or command metacharacters.
• Investigate any historical hits to the vulnerable endpoint as potential compromise, not just scanning, because exploitation is weaponized and unauthenticated.
• If compromise is suspected, isolate the device, preserve logs and disk artifacts, rebuild from trusted media, rotate associated credentials, and review adjacent systems for lateral movement.
• Add VIAware systems to recurring vulnerability management, external attack surface monitoring, and configuration baseline reviews.