Hgiga operates a focused portfolio of email security and messaging appliances, principally the MSR45 and SSR45 Isherlock product lines, which serve as gatekeepers for organizational communications infrastructure. Vulnerabilities affecting these products skew strongly toward critical severity and cluster persistently around input-handling weaknesses fundamental to web and command-processing interfaces: OS command injection, SQL injection, cross-site scripting, path traversal, and cross-site request forgery. The recurring nature of these weakness classes across the vendor's security appliances reflects the parsing and access-control demands of products designed to inspect, filter, and broker email traffic, and defenders treating these devices as security boundaries should prioritize patching to prevent command-execution and authentication-bypass chains. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hgiga over time
Signals from CVEs in this vendor scope (34 CVEs).
34 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-37913CRITICAL The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerab | Sep 15, 2021 | 9.8 | 32 | NO | NO |
CVE-2023-25909CRITICAL HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arb | Mar 27, 2023 | 9.8 | 31 | NO | NO |
CVE-2023-24838CRITICAL HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's credential. This cred | Mar 27, 2023 | 9.8 | 31 | NO | NO |
CVE-2021-22850CRITICAL HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions. | Jan 19, 2021 | 9.8 | 31 | NO | NO |
CVE-2020-25848CRITICAL HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism. | Dec 31, 2020 | 9.8 | 31 | NO | NO |
CVE-2021-37912CRITICAL The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulne | Sep 15, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-22848CRITICAL HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege. | Mar 18, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-22851CRITICAL HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data. | Jan 19, 2021 | 9.8 | 29 | NO | NO |
CVE-2020-35851CRITICAL HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of t | Dec 31, 2020 | 9.8 | 29 | NO | NO |
CVE-2024-26261CRITICAL The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request par | Feb 15, 2024 | 9.8 | 28 | NO | NO |
Signals from CVEs in this vendor scope (34 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hgiga.
Media articles that mention a CVE ID that affects a product developed by Hgiga — matched by CVE ID, not by vendor name.