CVE-2022-46377

Published May 10, 2023

Last updated a year ago

Overview

Description: An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no IP address argument is provided to the `PORT` command.
Source: talos-cna@cisco.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-125
talos-cna@cisco.com: CWE-823

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:weston-embedded:uc-ftps:1.98.00:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EBF1C85E-372F-44A2-B440-AC014D4801A3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References