by Kastro
Paper/Archive/CVE-2021-34584

CVE-2021-34584

CODESYS CODESYS V2 — CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 65.1.651 × 2013.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.

Affected

ProductAffectedFixed inSource
CODESYS V2all web servers – < V1.1.9.22V1.1.9.22CNA

Scores by source

CERTVDE (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refcustomers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=reftenable.com/security/research/tra-2021-47