CVE-2020-21238

CRITICAL

An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS0.9%
Percentile60th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-307: CWE-307
Related Attack Patterns (CAPEC)
CAPEC-16 Dictionary-based Password Attack
via CWE-307
CAPEC-565 Password Spraying
via CWE-307
CAPEC-49 Password Brute Forcing
via CWE-307
CAPEC-600 Credential Stuffing
via CWE-307
CAPEC-652 Use of Known Kerberos Credentials
via CWE-307
Show all 7

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in the user login box of CSCMS v4.0 allows attackers to hijack user accounts through brute force attacks, posing a significant security risk.

BSID: BS-2021-GLOBAL-148143-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-21238?
A vulnerability in the user login box of CSCMS v4.0 allows attackers to hijack user accounts through brute force attacks, posing a significant security risk.
What is the CVSS score for CVE-2020-21238?
CVE-2020-21238 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.9%.
Is CVE-2020-21238 actively exploited?
No confirmed active exploitation of CVE-2020-21238 as of 2026-05-30.
How do I remediate CVE-2020-21238?
Priority: IMMEDIATE.
What systems are affected by CVE-2020-21238?
CVE-2020-21238 affects Chshcms Cscms.
Vulnerability Details
CVE IDCVE-2020-21238
BSIDBS-2021-GLOBAL-148143-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2021-12-27
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-307
SourceNVD
Official Description

An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack vector involves an unsecured login mechanism that does not implement account lockout policies or rate limiting, enabling attackers to systematically guess user credentials until successful.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Chshcms Cscms 4.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1753 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashad14234e0991019ee146d5d3e447c857fe60d221eeb5bfef0466f3a2618512b167d20a8e67d2a1fc59c5e65dcd7fe8c8829ab356587ddecaab4814192b0f5803
Related CVEs affecting Chshcms
CVE-2020-28102 9.8 cscms v4.1 allows for SQL injection via the "js_del" function. CVE-2018-17126 9.8 CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cm... CVE-2018-16731 9.8 CScms 4.1 allows arbitrary file upload by (for example) adding the php extens... CVE-2020-22848 9.8 A remote code execution (RCE) vulnerability in the \Playsong.php component of... CVE-2020-28103 9.8 cscms v4.1 allows for SQL injection via the "page_del" function.
View all Chshcms CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →