PT-2023-14922 · Unknown · Weston Embedded Uc-Ftps

Kelly Leuschner · Publicado 2023-05-10 · Atualizado 2023-05-18 · CVE-2022-46377

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-FTPs version 1.98.00

Description An out-of-bounds read issue exists in the PORT command parameter extraction functionality. A specially-crafted set of network packets can lead to denial of service. This occurs when no IP address argument is provided to the PORT command. An attacker can send packets to trigger this issue.

Recommendations For Weston Embedded uC-FTPs version 1.98.00, consider restricting access to the PORT command until a patch is available. As a temporary workaround, ensure that an IP address argument is always provided to the PORT command to minimize the risk of exploitation.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

CWE-823

Identificadores relacionados

CVE-2022-46377

Produtos afetados

Weston Embedded Uc-Ftps

Referências · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681 · Exploit
• https://github.com/weston-embedded/uC-FTPs/pull/2 · Correção
• https://osv.dev/vulnerability/CVE-2022-46377 · Aviso do Fabricante
• https://t.me/cibsecurity/63803 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-46377 · Nota de Segurança