PT-2021-15172 · Texas Instruments · Simplelink Wi-Fi

David Atch + 1 · Published 2021-05-07 · Updated 2021-05-17 · CVE-2021-22679

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimpleLink Wi-Fi (MSP432E4 SDK) versions v4.20.00.12 and prior SimpleLink Wi-Fi (CC32XX SDK) versions v4.30.00.06 and prior SimpleLink Wi-Fi (CC13X0 SDK) versions prior to v4.10.03 SimpleLink Wi-Fi (CC13X2 and CC26XX SDK) versions prior to v4.40.00 SimpleLink Wi-Fi (CC3200 SDK) versions v1.5.0 and prior SimpleLink Wi-Fi (CC3100 SDK) versions v1.3.0 and prior

Description The issue is related to an integer overflow that occurs while processing HTTP headers. This may allow an attacker to remotely execute code.

Recommendations For MSP432E4 SDK versions v4.20.00.12 and prior, update to a version later than v4.20.00.12. For CC32XX SDK versions v4.30.00.06 and prior, update to a version later than v4.30.00.06. For CC13X0 SDK versions prior to v4.10.03, update to version v4.10.03 or later. For CC13X2 and CC26XX SDK versions prior to v4.40.00, update to version v4.40.00 or later. For CC3200 SDK versions v1.5.0 and prior, update to a version later than v1.5.0. For CC3100 SDK versions v1.3.0 and prior, update to a version later than v1.3.0.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2021-22679

Affected Products

Simplelink Wi-Fi

References · 4

• https://osv.dev/vulnerability/CVE-2021-22679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22679 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01 · Note
• https://t.me/cvenotify/14253 · Telegram Post