PT-2021-4714 · Fatek Automation · Winproladder
Natnael Samson
+2
·
Published
2021-10-07
·
Updated
2022-10-25
·
CVE-2021-38442
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FATEK Automation WinProladder versions 3.30 and prior
Description
The issue is related to the lack of proper validation of user-supplied data when parsing project files, which could result in a heap-corruption condition or buffer overflow. This could allow an attacker to execute code in the context of the current process by leveraging the vulnerability with a specially crafted file.
Recommendations
For versions 3.30 and prior, consider disabling the project file parsing functionality until a patch is available to prevent potential code execution.
Restrict access to the WinProladder software to minimize the risk of exploitation.
Avoid using the software to parse untrusted project files until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Winproladder