PT-2021-1698 · Fpwin Pro · Fpwin Pro

Francis Provencher · Published 2021-01-06 · Updated 2021-01-29 · CVE-2020-16236

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FPWIN Pro (affected versions not specified)

Description The issue is related to an out-of-bounds read vulnerability. When a user opens a maliciously crafted project file, it may allow an attacker to remotely execute arbitrary code. This can be achieved through the exploitation of a buffer overflow in memory, which occurs when the software attempts to read data from a memory location that is outside the boundaries of an allocated buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BDU:2021-00368

CVE-2020-16236

ZDI-21-068

Affected Products

Fpwin Pro

References · 7

• https://zerodayinitiative.com/advisories/ZDI-21-068 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16236 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00368 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16236 · Security Note
• https://t.me/cibsecurity/22609 · Telegram Post
• https://panasonic.com/global/corporate/product-security/sec/psirt.html · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-005-02 · Note