CVE-2021-27852: Checkbox Survey CheckboxWeb.dll deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is an unauthenticated network-reachable remote code execution with a 9.8 CVSS score and confirmed exploitation in CISA's KEV catalog.

What it is

CheckboxWeb.dll in Checkbox Survey deserializes untrusted data, allowing an unauthenticated remote attacker to execute arbitrary code. The flaw affects versions prior to 7, and CISA notes versions 6 and earlier are end-of-life and must be removed. With a CVSS base score of 9.8 and confirmed exploitation in the wild, this is a high-urgency issue for any organization still running the affected versions.

Impact

An attacker can run arbitrary code on the server hosting the vulnerable Checkbox Survey component, which typically means full compromise of the application and its data. Given the network-reachable, unauthenticated nature of the flaw, the attacker gains control without needing any credentials.

Attack surface

The vulnerability is reachable over the network through the CheckboxWeb.dll component, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed Checkbox Survey instance running a version prior to 7 is a candidate target.

Exploitation

CVE-2021-27852 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-11), confirming active exploitation, and EPSS shows a 30-day probability of 0.31946 (98.2nd percentile). No ransomware campaign use is documented in the record.

What to do

• Upgrade Checkbox Survey to version 7 or later, which is not considered vulnerable.
• Remove or decommission any Checkbox Survey version 6 or earlier installations, as CISA classifies them as end-of-life and requires removal from agency networks.
• If immediate upgrade or removal is not possible, isolate the affected host from untrusted networks and restrict access to the CheckboxWeb.dll endpoint.
• Monitor for and block deserialization-style payloads targeting Checkbox Survey endpoints at the network perimeter.
• Verify no residual Checkbox Survey components remain after remediation and re-scan for the vulnerable DLL.

Detection

• Search web and application logs for requests to CheckboxWeb.dll endpoints, especially unusual or oversized POST bodies consistent with serialized payloads.
• Monitor for unexpected child processes spawned by the Checkbox Survey application or its IIS worker process, which can indicate post-exploitation code execution.
• Inventory hosts and file systems for CheckboxWeb.dll and Checkbox Survey installations to identify unpatched or end-of-life versions.
• Correlate network traffic to known Checkbox Survey paths with outbound connections or command-and-control indicators from the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.