PT-2021-3762 · Delta Electronics · Diascreen

Kimiya · Published 2021-07-27 · Updated 2022-06-07 · CVE-2021-32965

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAScreen versions prior to 1.1.0

Description The issue is related to type confusion errors in the software for programmable logic controllers DIAScreen. This may allow an attacker to remotely execute arbitrary code by sending specially crafted data to the application. The vulnerability is associated with errors in mixing data types.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the DIAScreen software to minimize the risk of exploitation. Avoid using the software for parsing XLS files until the issue is resolved.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2021-04017

CVE-2021-32965

ZDI-21-1374

ZDI-22-025

ZDI-22-026

ZDI-22-027

Affected Products

Diascreen

References · 11

• https://zerodayinitiative.com/advisories/ZDI-22-026 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-025 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1374 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-027 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32965 · Security Note
• https://bdu.fstec.ru/vul/2021-04017 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32965 · Vendor Advisory
• https://t.me/cibsecurity/43299 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-208-05 · Note
• https://us-cert.gov/ics/advisories/icsa-21-208-05 · Note
• https://cybersecurity-help.cz/vdb/SB2021072804 · Note