An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processing function doesn't ensure that a filename is adequately '\0' terminated; therefore, a subsequent call to strlen for the filename might read out of bounds of the protocol packet buffer (if no '\0' byte exists within a reasonable range).
References
| Link | Resource |
|---|---|
| https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ | Mitigation Third Party Advisory |
| https://www.hcc-embedded.com/about/about-interniche | Product |
| https://www.kb.cert.org/vuls/id/608209 | Third Party Advisory US Government Resource |
Configurations
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
26 Aug 2021, 18:14
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-273 | |
| CPE | cpe:2.3:a:hcc-embedded:nichestack:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 7.8
v3 : 7.5 |
| References | (MISC) https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - Mitigation, Third Party Advisory | |
| References | (CERT-VN) https://www.kb.cert.org/vuls/id/608209 - Third Party Advisory, US Government Resource | |
| References | (MISC) https://www.hcc-embedded.com/about/about-interniche - Product |
19 Aug 2021, 13:02
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-19 12:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-36762
Mitre link : CVE-2021-36762
CVE.ORG link : CVE-2021-36762
JSON object : View
Products Affected
hcc-embedded
- nichestack
CWE