CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38434 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-38434
FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an unexpected sign extension. An attacker could leverage this vulnerability to execute arbitrary code. FATEK Automation WinProladder versiones 3.30 y anteriores, no comprueba correctamente los datos suministrados por el usuario cuando analiza los archivos de proyecto, que podría resultar en una extensión de signo no esperada. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 • CWE-194: Unexpected Sign Extension •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38438 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-38438
A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed project file, which may allow arbitrary code execution. Una vulnerabilidad de uso de memoria previamente liberada en FATEK Automation WinProladder versiones 3.30 y anteriores, puede ser explotada cuando un usuario válido abre un archivo de proyecto malformado, que puede permitir la ejecución de código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38442 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-38442
FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a heap-corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. FATEK Automation WinProladder versiones 3.30 y anteriores, no comprueba correctamente los datos suministrados por el usuario cuando analiza los archivos de proyecto, que podría resultar en una condición de corrupción de la pila. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-38432 – FATEK Automation Communication Server
https://notcve.org/view.php?id=CVE-2021-38432
FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code. FATEK Automation Communication Server versiones anteriores a 1.13, no comprueban correctamente los datos suministrados por el usuario, que podría resultar en una condición de desbordamiento del búfer en la región stack de la memoria y permitir a un atacante ejecutar código de forma remota This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation Communication Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of data sent to the Facon Server, which listens on port 500 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the FaconSvr process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-07 • CWE-121: Stack-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38430 – FATEK Automation WinProladder
https://notcve.org/view.php?id=CVE-2021-38430
FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files, which could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code. FATEK Automation WinProladder versiones 3.30 y anteriores, carece de una comprobación apropiada de los datos suministrados por el usuario cuando analiza los archivos de proyecto, que podría resultar en un desbordamiento del búfer en la región stack de la memoria. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation WinProladder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDW files. • https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 • CWE-121: Stack-based Buffer Overflow •