CVE-2021-27852
Checkbox Survey Deserialization of Untrusted Data Vulnerability
Published May 27, 2021 · updated Jun 16, 2026 · checkbox survey
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 27, 2021 · Catalog
Detected
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
Apr 11, 2022 · CISA KEV
Known exploited
Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
May 2, 2022 · CISA KEV
Remediation due
Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
Jun 16, 2026 · Catalog
Updated
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
Required action
Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
CISA due date May 2, 2022
Affected
- cpe checkbox/surveyversion unspecified
- vendor Checkbox Checkbox Surveyversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2021-27852
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
cisa.gov - CVE.orgVulnerability recordCVE-2021-27852
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-27852
30-day exploitation probability 30.3%
first.org - NIST NVDVulnerability recordCVE-2021-27852
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
nvd.nist.gov