The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-42540
• https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02