CVE-2021-22637
Fuji Electric V-Server Lite VPR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Se han identificado múltiples problemas de desbordamiento del búfer en la región stack de la memoria en la manera en que la aplicación procesa archivos de proyecto, permitiendo a un atacante diseñar un archivo de proyecto especial que puede permitir una ejecución de código arbitraria en el Tellus Lite V-Simulator y V-Server Lite (versiones anteriores a 4.0.10.0)
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric V-Server Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of VPR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-05 CVE Reserved
- 2021-01-27 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-121: Stack-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsa-21-026-01 | Third Party Advisory | |
| https://www.zerodayinitiative.com/advisories/ZDI-21-097 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fujielectric Search vendor "Fujielectric" | V-server Search vendor "Fujielectric" for product "V-server" | < 4.0.10.0 Search vendor "Fujielectric" for product "V-server" and version " < 4.0.10.0" | lite |
Affected
| ||||||
| Fujielectric Search vendor "Fujielectric" | V-simulator Search vendor "Fujielectric" for product "V-simulator" | < 4.0.10.0 Search vendor "Fujielectric" for product "V-simulator" and version " < 4.0.10.0" | lite |
Affected
| ||||||