CVE-2021-44207
Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability
Description
CVE-2021-44207 is a high-severity vulnerability in Acclaim Systems USAHERDS, a web-based animal health management application used by state departments of agriculture across the United States. The software through version 7.4.0.1 uses hard-coded credentials, enabling remote attackers to gain unauthorized access to the application and its underlying data. With a CVSS v3.1 base score of 8.1 and an EPSS score of 8.92% at the 92nd percentile, the vulnerability poses significant risk to government agencies relying on USAHERDS for livestock disease tracking and management. CISA has added CVE-2021-44207 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 13, 2025, confirming that this flaw has been actively exploited in real-world attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| acclaimsystems | usaherds | <= 7.4.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0012/MNDT-2021-0012.md(Third Party Advisory)
- https://www.acclaimsystems.com(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44207(US Government Resource)
Weakness Type
Hard-Coded Credentials
CVE-2021-44207 involves the use of hard-coded credentials embedded directly in the USAHERDS application. This class of vulnerability occurs when a software product contains fixed authentication values such as passwords, cryptographic keys, or API tokens compiled into the source code or configuration files that ship with the product. In the case of USAHERDS, these hard-coded credentials allow any attacker who discovers them to authenticate to the application without needing to compromise legitimate user accounts. Hard-coded credentials are particularly dangerous because they cannot be changed through normal administrative procedures and remain identical across all installations of the affected software version, meaning that once the credentials are known, every deployment becomes vulnerable simultaneously.
Impact Analysis
The impact of CVE-2021-44207 is severe across all three dimensions of the CIA triad, each rated High in the CVSS assessment. Confidentiality is critically compromised because hard-coded credentials grant attackers direct access to the USAHERDS application and all the sensitive agricultural and livestock health data it manages. This includes animal disease tracking records, farm location data, veterinary inspection reports, and potentially personally identifiable information of livestock owners and agricultural workers.
Integrity faces maximum impact as authenticated access enables the attacker to modify, insert, or delete records within the animal health management system. Manipulation of disease tracking data could have far-reaching consequences for public health and agricultural policy, potentially concealing disease outbreaks or creating false reports that trigger unnecessary emergency responses.
Availability is also rated High because full application access allows an attacker to disrupt or disable the USAHERDS system, potentially crippling a state's ability to monitor and respond to animal disease events. The attack vector is network-based (AV:N) but requires high complexity (AC:H), reflecting that the attacker must first obtain or discover the hard-coded credentials. However, once credentials are known, no user interaction is required (UI:N) and no prior privileges are needed (PR:N). The EPSS score of 8.92% at the 92nd percentile indicates significant exploitation probability, and this vulnerability was notably exploited by the APT41 threat group in campaigns targeting U.S. state government networks.
Exploit Maturity
CVE-2021-44207 has confirmed high exploit maturity, demonstrated by its inclusion in CISA's Known Exploited Vulnerabilities catalog and documented use in advanced persistent threat operations. The vulnerability was disclosed by Mandiant as part of their investigation into APT41 campaigns targeting U.S. state government networks in 2021. The APT41 group, a Chinese state-sponsored threat actor, exploited the hard-coded credentials in USAHERDS as part of a broader campaign to infiltrate government systems.
The EPSS score of 8.92% at the 92nd percentile reflects a high probability of exploitation. The fact that this vulnerability was weaponized by a sophisticated nation-state actor demonstrates that the hard-coded credentials have been extracted and are likely available within threat actor communities. While CISA lists the ransomware association as unknown, the involvement of APT41 indicates that exploitation serves strategic intelligence-gathering objectives rather than financial extortion. The combination of government-sector targeting, confirmed APT exploitation, and the inherent simplicity of using known credentials makes this vulnerability particularly concerning for any organization still running unpatched USAHERDS installations.
Remediation
-
Upgrade USAHERDS immediately. Contact Acclaim Systems to obtain a patched version of the software that removes or replaces the hard-coded credentials. Visit acclaimsystems.com for vendor support and update guidance. Given the confirmed APT exploitation, this should be treated as the highest remediation priority.
-
Conduct a forensic investigation of affected systems. Because this vulnerability was exploited by APT41 in campaigns against state government networks, any organization running USAHERDS 7.4.0.1 or earlier should assume potential compromise. Review access logs, audit user account activity, and check for signs of unauthorized data access or lateral movement within the network.
-
Restrict network access to the USAHERDS application. Implement network segmentation to limit which hosts and users can reach the USAHERDS application. Deploy firewall rules and access control lists to prevent external access to the application from untrusted networks, reducing the attack surface while patches are being applied.
-
Rotate all associated credentials and secrets. After patching, change all database passwords, service account credentials, API keys, and any other authentication tokens associated with the USAHERDS deployment. The hard-coded credentials may have been used to pivot to other systems or extract additional secrets.
-
Implement monitoring and detection controls. Deploy network intrusion detection signatures and endpoint monitoring to detect any future unauthorized access attempts against the USAHERDS application. Monitor for indicators of compromise associated with APT41 activity as documented by Mandiant and CISA.
Technical Details
CVE-2021-44207 is a hard-coded credentials vulnerability in Acclaim Systems USAHERDS through version 7.4.0.1. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-accessible attack with high complexity, no privilege requirements, no user interaction needed, and high impact across confidentiality, integrity, and availability.
The vulnerability stems from authentication credentials that are embedded directly in the USAHERDS application code or configuration files. These credentials are identical across all installations of the affected versions, meaning that once extracted from any single deployment, they provide access to every other deployment running the same version. The high attack complexity rating (AC:H) reflects that the attacker must first discover or obtain these hard-coded credentials, which may require reverse engineering the application, accessing source code, or obtaining them from a compromised installation.
USAHERDS is a web application used by state departments of agriculture to manage animal health programs, including disease surveillance, livestock tracking, and veterinary inspection coordination. The application handles sensitive government data and connects to backend databases containing comprehensive records about agricultural operations within each state. Successful exploitation using the hard-coded credentials grants the attacker full authenticated access to the application and its data stores.
The vulnerability was identified during Mandiant's investigation into APT41 intrusions targeting U.S. state government networks. The threat group leveraged the hard-coded credentials as an initial access vector or lateral movement technique within compromised government environments. The affected version scope covers all USAHERDS releases through 7.4.0.1, indicating the hard-coded credentials were present from early versions of the software.
Frequently Asked Questions
What is CVE-2021-44207?
CVE-2021-44207 is a hard-coded credentials vulnerability in Acclaim Systems USAHERDS, a web-based animal health management application. The software through version 7.4.0.1 contains fixed authentication credentials that allow remote attackers to gain unauthorized access.
Who exploited this vulnerability?
The vulnerability was exploited by APT41, a Chinese state-sponsored threat group, as part of campaigns targeting U.S. state government networks. Mandiant disclosed the vulnerability during their investigation of these intrusions.
What data is at risk from CVE-2021-44207?
USAHERDS manages animal health programs for state departments of agriculture, so at-risk data includes livestock disease tracking records, farm location information, veterinary inspection reports, and potentially personal information of livestock owners and agricultural workers.
How can organizations determine if they were compromised?
Organizations should review USAHERDS application logs for unauthorized access, audit user account activity for anomalies, and check for indicators of compromise associated with APT41 as documented by Mandiant and CISA. Network traffic analysis for unusual data exfiltration patterns is also recommended.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.