← Retour aux CVEs

CVE-2021-27417

MEDIUM

4.6

Description

eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.

Details CVE

Score CVSS v3.14.6

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:H

Vecteur d'attaqueLOCAL

ComplexiteHIGH

Privileges requisHIGH

Interaction utilisateurREQUIRED

Publie5/3/2022

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

ecoscentric:ecospro

Faiblesses (CWE)

CWE-190CWE-190

References

https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437(ics-cert@hq.dhs.gov)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04(ics-cert@hq.dhs.gov)

https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.