PT-2023-14923 · Unknown · Weston Embedded Uc-Ftps

Kelly Leuschner · Publicado 2023-05-10 · Atualizado 2023-05-18 · CVE-2022-46378

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-FTPs version 1.98.00

Description An out-of-bounds read issue exists in the PORT command parameter extraction functionality. This can be triggered by a specially-crafted set of network packets, leading to denial of service. The issue occurs when no port argument is provided to the PORT command. An attacker can exploit this by sending specific packets.

Recommendations For Weston Embedded uC-FTPs version 1.98.00, consider restricting access to the PORT command until a patch is available. As a temporary workaround, ensure that a port argument is always provided to the PORT command to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Enumeração de Fraquezas

CWE-125

CWE-823

Identificadores relacionados

CVE-2022-46378

Produtos afetados

Weston Embedded Uc-Ftps

Referências · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681 · Exploit
• https://github.com/weston-embedded/uC-FTPs/pull/2 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2022-46378 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-46378 · Aviso do Fabricante
• https://t.me/cibsecurity/63813 · Publicação no Telegram