Common Weakness Enumeration
CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
5243 vulnerabilities reference this CWE, most recent first.
CVE-2021-33546 (GCVE-0-2021-33546)
Vulnerability from cvelistv5 – Published: 2021-09-13 17:55 – Updated: 2024-09-17 04:24
VLAI
EPSS
VEX
Title
UDP Technology/Geutebrück camera devices: Buffer overflow in name parameter leading to RCE
Summary
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code.
Severity
7.2 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.randorisec.fr/fr/udp-technology-ip-ca… | x_refsource_CONFIRM |
| https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03 | x_refsource_CONFIRM |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Geutebrück | E2 Series |
Affected:
EBC-21xx 1.12.13.2
Affected: EBC-21xx 1.12.14.5 Affected: EFD-22xx 1.12.13.2 Affected: EFD-22xx 1.12.14.5 Affected: ETHC-22xx 1.12.13.2 Affected: ETHC-22xx 1.12.14.5 Affected: EWPC-22xx 1.12.13.2 Affected: EWPC-22xx 1.12.14.5 Affected: EBC-21xx , ≤ 1.12.0.27 (custom) Affected: EFD-22xx , ≤ 1.12.0.27 (custom) Affected: ETHC-22xx , ≤ 1.12.0.27 (custom) Affected: EWPC-22xx , ≤ 1.12.0.27 (custom) |
|
| Geutebrück | Encoder G-Code |
Affected:
EEC-2xx 1.12.13.2
Affected: EEC-2xx 1.12.14.5 Affected: EEN-20xx 1.12.13.2 Affected: EEN-20xx 1.12.14.5 Affected: EEC-2xx , ≤ 1.12.0.27 (custom) Affected: EEN-20xx , ≤ 1.12.0.27 (custom) |
Date Public
2021-08-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:43.091Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "E2 Series",
"vendor": "Geutebr\u00fcck",
"versions": [
{
"status": "affected",
"version": "EBC-21xx 1.12.13.2"
},
{
"status": "affected",
"version": "EBC-21xx 1.12.14.5"
},
{
"status": "affected",
"version": "EFD-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "EFD-22xx 1.12.14.5"
},
{
"status": "affected",
"version": "ETHC-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "ETHC-22xx 1.12.14.5"
},
{
"status": "affected",
"version": "EWPC-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "EWPC-22xx 1.12.14.5"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EBC-21xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EFD-22xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "ETHC-22xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EWPC-22xx",
"versionType": "custom"
}
]
},
{
"product": "Encoder G-Code",
"vendor": "Geutebr\u00fcck",
"versions": [
{
"status": "affected",
"version": "EEC-2xx 1.12.13.2"
},
{
"status": "affected",
"version": "EEC-2xx 1.12.14.5"
},
{
"status": "affected",
"version": "EEN-20xx 1.12.13.2"
},
{
"status": "affected",
"version": "EEN-20xx 1.12.14.5"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EEC-2xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EEN-20xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities."
}
],
"datePublic": "2021-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-13T17:55:36.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "UDP Technology/Geutebr\u00fcck camera devices: Buffer overflow in name parameter leading to RCE",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-08-31T22:00:00.000Z",
"ID": "CVE-2021-33546",
"STATE": "PUBLIC",
"TITLE": "UDP Technology/Geutebr\u00fcck camera devices: Buffer overflow in name parameter leading to RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "E2 Series",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "EBC-21xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EBC-21xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EBC-21xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EFD-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EFD-22xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EFD-22xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "ETHC-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "ETHC-22xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "ETHC-22xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EWPC-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EWPC-22xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EWPC-22xx",
"version_value": "1.12.14.5"
}
]
}
},
{
"product_name": "Encoder G-Code",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "EEC-2xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EEC-2xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EEC-2xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EEN-20xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EEN-20xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EEN-20xx",
"version_value": "1.12.14.5"
}
]
}
}
]
},
"vendor_name": "Geutebr\u00fcck"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/",
"refsource": "CONFIRM",
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-33546",
"datePublished": "2021-09-13T17:55:36.920Z",
"dateReserved": "2021-05-24T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:24:10.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33545 (GCVE-0-2021-33545)
Vulnerability from cvelistv5 – Published: 2021-09-13 17:55 – Updated: 2024-09-17 01:55
VLAI
EPSS
VEX
Title
UDP Technology/Geutebrück camera devices: Buffer overflow in counter parameter leading to RCE
Summary
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code.
Severity
7.2 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.randorisec.fr/fr/udp-technology-ip-ca… | x_refsource_CONFIRM |
| https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03 | x_refsource_CONFIRM |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Geutebrück | E2 Series |
Affected:
EBC-21xx 1.12.13.2
Affected: EBC-21xx 1.12.14.5 Affected: EFD-22xx 1.12.13.2 Affected: EFD-22xx 1.12.14.5 Affected: ETHC-22xx 1.12.13.2 Affected: ETHC-22xx 1.12.14.5 Affected: EWPC-22xx 1.12.13.2 Affected: EWPC-22xx 1.12.14.5 Affected: EBC-21xx , ≤ 1.12.0.27 (custom) Affected: EFD-22xx , ≤ 1.12.0.27 (custom) Affected: ETHC-22xx , ≤ 1.12.0.27 (custom) Affected: EWPC-22xx , ≤ 1.12.0.27 (custom) |
|
| Geutebrück | Encoder G-Code |
Affected:
EEC-2xx 1.12.13.2
Affected: EEC-2xx 1.12.14.5 Affected: EEN-20xx 1.12.13.2 Affected: EEN-20xx 1.12.14.5 Affected: EEC-2xx , ≤ 1.12.0.27 (custom) Affected: EEN-20xx , ≤ 1.12.0.27 (custom) |
Date Public
2021-08-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "E2 Series",
"vendor": "Geutebr\u00fcck",
"versions": [
{
"status": "affected",
"version": "EBC-21xx 1.12.13.2"
},
{
"status": "affected",
"version": "EBC-21xx 1.12.14.5"
},
{
"status": "affected",
"version": "EFD-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "EFD-22xx 1.12.14.5"
},
{
"status": "affected",
"version": "ETHC-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "ETHC-22xx 1.12.14.5"
},
{
"status": "affected",
"version": "EWPC-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "EWPC-22xx 1.12.14.5"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EBC-21xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EFD-22xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "ETHC-22xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EWPC-22xx",
"versionType": "custom"
}
]
},
{
"product": "Encoder G-Code",
"vendor": "Geutebr\u00fcck",
"versions": [
{
"status": "affected",
"version": "EEC-2xx 1.12.13.2"
},
{
"status": "affected",
"version": "EEC-2xx 1.12.14.5"
},
{
"status": "affected",
"version": "EEN-20xx 1.12.13.2"
},
{
"status": "affected",
"version": "EEN-20xx 1.12.14.5"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EEC-2xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EEN-20xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities."
}
],
"datePublic": "2021-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-13T17:55:35.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "UDP Technology/Geutebr\u00fcck camera devices: Buffer overflow in counter parameter leading to RCE",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-08-31T22:00:00.000Z",
"ID": "CVE-2021-33545",
"STATE": "PUBLIC",
"TITLE": "UDP Technology/Geutebr\u00fcck camera devices: Buffer overflow in counter parameter leading to RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "E2 Series",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "EBC-21xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EBC-21xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EBC-21xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EFD-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EFD-22xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EFD-22xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "ETHC-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "ETHC-22xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "ETHC-22xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EWPC-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EWPC-22xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EWPC-22xx",
"version_value": "1.12.14.5"
}
]
}
},
{
"product_name": "Encoder G-Code",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "EEC-2xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EEC-2xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EEC-2xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EEN-20xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EEN-20xx",
"version_value": "1.12.13.2"
},
{
"version_affected": "=",
"version_name": "EEN-20xx",
"version_value": "1.12.14.5"
}
]
}
}
]
},
"vendor_name": "Geutebr\u00fcck"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/",
"refsource": "CONFIRM",
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-33545",
"datePublished": "2021-09-13T17:55:35.310Z",
"dateReserved": "2021-05-24T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:55:45.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33019 (GCVE-0-2021-33019)
Vulnerability from cvelistv5 – Published: 2021-08-30 17:09 – Updated: 2024-08-03 23:42
VLAI
EPSS
VEX
Summary
A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code.
Severity
No CVSS data available.
CWE
- CWE-121 - STACK-BASED BUFFER OVERFLOW CWE-121
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsa-21-238-04 | x_refsource_MISC |
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Delta Electronics DOPSoft |
Affected:
DOPSoft Version 4.00.11 and prior
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:42:18.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-238-04"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1059/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Delta Electronics DOPSoft",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "DOPSoft Version 4.00.11 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "STACK-BASED BUFFER OVERFLOW CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-08T18:06:14.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-238-04"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1059/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-33019",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Delta Electronics DOPSoft",
"version": {
"version_data": [
{
"version_value": "DOPSoft Version 4.00.11 and prior"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "STACK-BASED BUFFER OVERFLOW CWE-121"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-238-04",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-238-04"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-1059/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1059/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-33019",
"datePublished": "2021-08-30T17:09:35.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:42:18.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32976 (GCVE-0-2021-32976)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:33
VLAI
EPSS
VEX
Title
Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer Overflow
Summary
Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_CONFIRM |
| https://www.moxa.com/en/support/product-support/s… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Moxa | NPort IAW5000A-I/O series firmware |
Affected:
unspecified , ≤ 2.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-187-01"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.moxa.com/en/support/product-support/security-advisory/nport-iaw5000a-io-serial-device-server-vulnerabilities"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32976",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:56:27.792123Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:33:12.438Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NPort IAW5000A-I/O series firmware",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "2.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar reported these vulnerabilities to Moxa."
}
],
"descriptions": [
{
"lang": "en",
"value": "Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:14.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-187-01"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.moxa.com/en/support/product-support/security-advisory/nport-iaw5000a-io-serial-device-server-vulnerabilities"
}
],
"solutions": [
{
"lang": "en",
"value": "Moxa has developed solutions to address these vulnerabilities. Please contact Moxa Technical Support for a security patch.\n\nMoxa has also published a security advisory to provide more information."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32976",
"STATE": "PUBLIC",
"TITLE": "Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer Overflow"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NPort IAW5000A-I/O series firmware",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "2.2"
}
]
}
}
]
},
"vendor_name": "Moxa"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar reported these vulnerabilities to Moxa."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-187-01",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-187-01"
},
{
"name": "https://www.moxa.com/en/support/product-support/security-advisory/nport-iaw5000a-io-serial-device-server-vulnerabilities",
"refsource": "CONFIRM",
"url": "https://www.moxa.com/en/support/product-support/security-advisory/nport-iaw5000a-io-serial-device-server-vulnerabilities"
}
]
},
"solution": [
{
"lang": "en",
"value": "Moxa has developed solutions to address these vulnerabilities. Please contact Moxa Technical Support for a security patch.\n\nMoxa has also published a security advisory to provide more information."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32976",
"datePublished": "2022-04-01T22:17:14.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:33:12.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32947 (GCVE-0-2021-32947)
Vulnerability from cvelistv5 – Published: 2021-08-11 12:44 – Updated: 2024-08-03 23:33
VLAI
EPSS
VEX
Summary
FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
Severity
No CVSS data available.
CWE
- CWE-121 - STACK-BASED BUFFER OVERFLOW CWE-121
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsa-21-217-02 | x_refsource_MISC |
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | FATEK Automation FvDesigner |
Affected:
FvDesigner, Versions 1.5.88 and prior
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.244Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-02"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1029/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FATEK Automation FvDesigner",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "FvDesigner, Versions 1.5.88 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "STACK-BASED BUFFER OVERFLOW CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-27T09:06:34.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-02"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1029/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32947",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FATEK Automation FvDesigner",
"version": {
"version_data": [
{
"version_value": "FvDesigner, Versions 1.5.88 and prior"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "STACK-BASED BUFFER OVERFLOW CWE-121"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-02",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-02"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-1029/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1029/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32947",
"datePublished": "2021-08-11T12:44:53.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:56.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32943 (GCVE-0-2021-32943)
Vulnerability from cvelistv5 – Published: 2021-08-10 14:03 – Updated: 2024-08-03 23:33
VLAI
EPSS
VEX
Summary
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).
Severity
No CVSS data available.
CWE
- CWE-121 - STACK-BASED BUFFER OVERFLOW CWE-121
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | WebAccess/SCADA |
Affected:
WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:55.931Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WebAccess/SCADA",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "STACK-BASED BUFFER OVERFLOW CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-10T14:03:48.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32943",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "WebAccess/SCADA",
"version": {
"version_data": [
{
"version_value": "WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "STACK-BASED BUFFER OVERFLOW CWE-121"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32943",
"datePublished": "2021-08-10T14:03:48.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:55.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32941 (GCVE-0-2021-32941)
Vulnerability from cvelistv5 – Published: 2022-05-23 18:51 – Updated: 2025-04-16 16:19
VLAI
EPSS
VEX
Title
Annke Network Video Recorder - Stack-based Buffer Overflow
Summary
Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user (root).
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Annke | N48PBB (NVR) |
Affected:
All , ≤ V3.4.106 build 200422
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.119Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32941",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:55:48.555862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:19:18.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "N48PBB (NVR)",
"vendor": "Annke",
"versions": [
{
"lessThanOrEqual": "V3.4.106 build 200422",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Andrea Palanca from Nozomi Networks reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"value": "Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user (root)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-23T18:51:57.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-02"
}
],
"source": {
"advisory": "ICSA-21-238-02",
"discovery": "UNKNOWN"
},
"title": "Annke Network Video Recorder - Stack-based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32941",
"STATE": "PUBLIC",
"TITLE": "Annke Network Video Recorder - Stack-based Buffer Overflow"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "N48PBB (NVR)",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "All",
"version_value": "V3.4.106 build 200422"
}
]
}
}
]
},
"vendor_name": "Annke"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Andrea Palanca from Nozomi Networks reported this vulnerability to CISA."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user (root)."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-02"
}
]
},
"source": {
"advisory": "ICSA-21-238-02",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32941",
"datePublished": "2022-05-23T18:51:57.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:19:18.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32040 (GCVE-0-2021-32040)
Vulnerability from cvelistv5 – Published: 2022-04-12 14:15 – Updated: 2024-09-16 20:03
VLAI
EPSS
VEX
Title
Large aggregation pipelines with a specific stage can crash mongod under default configuration
Summary
It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16.
Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://jira.mongodb.org/browse/SERVER-58203 | x_refsource_MISC |
| https://jira.mongodb.org/browse/SERVER-59299 | x_refsource_MISC |
| https://jira.mongodb.org/browse/SERVER-60218 | x_refsource_MISC |
| https://security.netapp.com/advisory/ntap-2022060… | x_refsource_CONFIRM |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB Inc. | MongoDB Server |
Affected:
5.0 , < 5.0.4
(custom)
Affected: 4.4 , ≤ 4.4.28 (custom) Affected: 4.2 , < 4.2.16 (custom) |
|
| mongodb | mongodb |
Affected:
5.0 , < 5.0.4
(custom)
Affected: 4.4 , ≤ 4.4.28 (custom) Affected: 4.2 , < 4.2.16 (custom) cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* |
Date Public
2022-04-11 23:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:17:29.135Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.mongodb.org/browse/SERVER-58203"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.mongodb.org/browse/SERVER-59299"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.mongodb.org/browse/SERVER-60218"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20220609-0005/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mongodb",
"vendor": "mongodb",
"versions": [
{
"lessThan": "5.0.4",
"status": "affected",
"version": "5.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.4.28",
"status": "affected",
"version": "4.4",
"versionType": "custom"
},
{
"lessThan": "4.2.16",
"status": "affected",
"version": "4.2",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32040",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-23T18:16:37.734248Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T17:07:34.494Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB Inc.",
"versions": [
{
"lessThan": "5.0.4",
"status": "affected",
"version": "5.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.4.28",
"status": "affected",
"version": "4.4",
"versionType": "custom"
},
{
"lessThan": "4.2.16",
"status": "affected",
"version": "4.2",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-04-11T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIt may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWorkaround:\u0026nbsp;\u0026gt;= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16.\n\nWorkaround:\u00a0\u003e= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-23T16:04:43.143Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mongodb.org/browse/SERVER-58203"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mongodb.org/browse/SERVER-59299"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mongodb.org/browse/SERVER-60218"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20220609-0005/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Large aggregation pipelines with a specific stage can crash mongod under default configuration",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u0026gt;= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash."
}
],
"value": "\u003e= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@mongodb.com",
"DATE_PUBLIC": "2022-04-12T20:00:00.000Z",
"ID": "CVE-2021-32040",
"STATE": "PUBLIC",
"TITLE": "Large aggregation pipelines with a specific stage can crash mongod under default configuration"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MongoDB Server",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "5.0",
"version_value": "5.0.4"
},
{
"version_affected": "\u003c",
"version_name": "4.4",
"version_value": "4.4.11"
},
{
"version_affected": "\u003c",
"version_name": "4.2",
"version_value": "4.2.16"
}
]
}
}
]
},
"vendor_name": "MongoDB Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB versions prior to 5.0.4, 4.4.11, 4.2.16."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.mongodb.org/browse/SERVER-58203",
"refsource": "MISC",
"url": "https://jira.mongodb.org/browse/SERVER-58203"
},
{
"name": "https://jira.mongodb.org/browse/SERVER-59299",
"refsource": "MISC",
"url": "https://jira.mongodb.org/browse/SERVER-59299"
},
{
"name": "https://jira.mongodb.org/browse/SERVER-60218",
"refsource": "MISC",
"url": "https://jira.mongodb.org/browse/SERVER-60218"
},
{
"name": "https://security.netapp.com/advisory/ntap-20220609-0005/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20220609-0005/"
}
]
},
"source": {
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "\u003e=4.2.16 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2021-32040",
"datePublished": "2022-04-12T14:15:16.692Z",
"dateReserved": "2021-05-05T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:03:21.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-31507 (GCVE-0-2021-31507)
Vulnerability from cvelistv5 – Published: 2021-06-29 14:33 – Updated: 2024-08-03 23:03
VLAI
EPSS
VEX
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12653.
Severity
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenText | Brava! Desktop |
Affected:
16.6.3.84
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:03:33.291Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-685/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Brava! Desktop",
"vendor": "OpenText",
"versions": [
{
"status": "affected",
"version": "16.6.3.84"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "rgod"
}
],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12653."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-29T14:33:50.000Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-685/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "zdi-disclosures@trendmicro.com",
"ID": "CVE-2021-31507",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Brava! Desktop",
"version": {
"version_data": [
{
"version_value": "16.6.3.84"
}
]
}
}
]
},
"vendor_name": "OpenText"
}
]
}
},
"credit": "rgod",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12653."
}
]
},
"impact": {
"cvss": {
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121: Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-685/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-685/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2021-31507",
"datePublished": "2021-06-29T14:33:50.000Z",
"dateReserved": "2021-04-16T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:03:33.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-31438 (GCVE-0-2021-31438)
Vulnerability from cvelistv5 – Published: 2021-04-29 16:31 – Updated: 2024-08-03 22:55
VLAI
EPSS
VEX
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12443.
Severity
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.foxitsoftware.com/support/security-bu… | x_refsource_MISC |
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Foxit | Studio Photo |
Affected:
3.6.6.931
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:55:53.727Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.foxitsoftware.com/support/security-bulletins.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-481/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Studio Photo",
"vendor": "Foxit",
"versions": [
{
"status": "affected",
"version": "3.6.6.931"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Francis Provencher {PRL}"
}
],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12443."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-29T16:31:17.000Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.foxitsoftware.com/support/security-bulletins.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-481/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "zdi-disclosures@trendmicro.com",
"ID": "CVE-2021-31438",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Studio Photo",
"version": {
"version_data": [
{
"version_value": "3.6.6.931"
}
]
}
}
]
},
"vendor_name": "Foxit"
}
]
}
},
"credit": "Francis Provencher {PRL}",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12443."
}
]
},
"impact": {
"cvss": {
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121: Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.foxitsoftware.com/support/security-bulletins.html",
"refsource": "MISC",
"url": "https://www.foxitsoftware.com/support/security-bulletins.html"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-481/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-481/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2021-31438",
"datePublished": "2021-04-29T16:31:17.000Z",
"dateReserved": "2021-04-16T00:00:00.000Z",
"dateUpdated": "2024-08-03T22:55:53.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.