CVE-2021-35064: KramerAV VIAWare sudo misconfiguration privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction and public exploit references make this a high-impact, easily reachable privilege escalation.

What it is

KramerAV VIAWare ships with a sudoers configuration that lets users run dangerous commands such as unzip, systemctl and dpkg. Because those commands can execute arbitrary code or load files, the misconfiguration turns a low-privileged position into full root control of the device.

Impact

An attacker gains root-level privileges on the VIAWare host, allowing full control of the device, its data and any connected services.

Attack surface

The CVSS vector is network-reachable with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N), so the sudo misconfiguration can be reached directly over the network. No credentials or victim action are required per the vector.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.70753, 99.366th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor's fix or update VIAWare to a version with a corrected sudoers configuration.
• Remove unzip, systemctl, dpkg and any other unnecessary commands from sudoers; restrict sudo to the minimum required binaries.
• Restrict network access to VIAWare management interfaces to trusted segments only.
• Audit sudoers on all VIAWare deployments for similar dangerous command grants.
• Monitor and alert on sudo invocations of unzip, systemctl and dpkg by non-administrative users.

Detection

• Monitor sudo logs for executions of unzip, systemctl or dpkg by unexpected users.
• Alert on new or modified files in privileged paths following sudo use of those binaries.
• Baseline and review sudoers file contents for dangerous command entries.
• Watch for network access to VIAWare management ports from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.