CVE-2021-27852VulnerabilityPublished 04/11/2022Updated 10/24/2026

CVE-2021-27852: Checkbox Survey Deserialization of Untrusted Data Vulnerability

Affects Checkbox Checkbox SurveySource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 04/11/2022
KEV deadline: 05/02/2022
EPSS: 30.3% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.

nvd.nist.gov/vuln/detail/CVE-2021-27852 (opens in a new tab)

Description

CVE-2021-27852 is a deserialization of untrusted data vulnerability in Checkbox Survey's CheckboxWeb.dll component. This flaw allows an unauthenticated remote attacker to execute arbitrary code on affected systems. The vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information are provided in the available data.

Summary

The vulnerability identified as CVE-2021-27852 exists in the CheckboxWeb.dll component of Checkbox Survey. It involves unsafe deserialization of untrusted data, which can be exploited remotely without authentication to execute arbitrary code. This type of vulnerability is classified under CWE-502. The presence of known exploitation in the wild underscores the critical nature of this security issue. However, no vendor advisory or patch information is currently available to confirm remediation status or affected versions.

Impact

Successful exploitation enables unauthenticated remote attackers to execute arbitrary code on vulnerable Checkbox Survey installations. This can lead to full system compromise, data breaches, or further network penetration. The fact that exploitation is observed in the wild increases the urgency and risk associated with this vulnerability.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to Checkbox Survey instances, applying network-level protections, and monitoring for exploitation attempts.

Weaknesses

CWE-502Deserialization of Untrusted Data (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:26:00 UTC

Weaknesses

References

Related threats