Incydr (Code42)
CVE-2021-43269: In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to u…
In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (PAC) file, leading to arbitrary code execution.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| n/a n/a | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (PAC) file, leading to arbitrary code execution. This affects Incydr Basic, Advanced, and Gov F1; CrashPlan Cloud; and CrashPlan for Small Business. (Incydr Professional and Enterprise are unaffected.)
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.