by Kastro
Paper/Archive/CVE-2021-22802

CVE-2021-22802

schneider — A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing leng…

EPSS 20%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.5.975 × 2019.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user supplied data, when a constructed message is received on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)

Affected

ProductAffectedFixed inSource
Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03