Is CVE-2021-44477 actively exploited?

No active exploitation of CVE-2021-44477 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-44477 be exploited remotely?

Yes. CVE-2021-44477 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-44477?

CVE-2021-44477 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2021-44477

HIGH

CVE-2021-44477

CWE-611Published: March 25, 2022· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.

NVD Source

Technical Analysis

CVE-2021-44477 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.