by Kastro
Paper/Archive/CVE-2021-38443

CVE-2021-38443

Eclipse CycloneDDS — Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.9.819 × 2016.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.

Affected

ProductAffectedFixed inSource
CycloneDDSunspecified – < 0.8.00.8.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)6.6CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcisa.gov/uscert/ics/advisories/icsa-21-315-02refprojects.eclipse.org/projects/iot.cyclonedds