CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43554 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-43554
FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code. FATEK WinProladder versiones 3.30_24518 y anteriores, son vulnerables a una escritura fuera de límites mientras son procesados archivos de proyecto, lo que puede permitir a un atacante ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-320-01 https://www.zerodayinitiative.com/advisories/ZDI-22-028 https://www.zerodayinitiative.com/advisories/ZDI-22-030 https://www.zerodayinitiative.com/advisories/ZDI-22-033 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43556 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-43556
FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code. Las versiones 3.30_24518 y anteriores de FATEK WinProladder son vulnerables a un desbordamiento del búfer en la región stack de la memoria mientras son procesados archivos de proyecto, lo que puede permitir a un atacante ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-320-01 https://www.zerodayinitiative.com/advisories/ZDI-22-029 https://www.zerodayinitiative.com/advisories/ZDI-22-031 https://www.zerodayinitiative.com/advisories/ZDI-22-032 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38436 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-38436
FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a memory-corruption condition. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. FATEK Automation WinProladder versiones 3.30 y anteriores, no comprueba correctamente los datos suministrados por el usuario cuando analiza los archivos de proyecto, que podría resultar en una condición de corrupción de memoria. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código arbitrario en el contexto del proceso actual • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38426 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-38426
FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code. FATEK Automation WinProladder versiones 3.30 y anteriores, no comprueba correctamente los datos suministrados por el usuario cuando analiza los archivos de proyecto, que podría resultar en una escritura fuera de límites. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38434 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-38434
FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an unexpected sign extension. An attacker could leverage this vulnerability to execute arbitrary code. FATEK Automation WinProladder versiones 3.30 y anteriores, no comprueba correctamente los datos suministrados por el usuario cuando analiza los archivos de proyecto, que podría resultar en una extensión de signo no esperada. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 • CWE-194: Unexpected Sign Extension •