PT-2021-7368 · Wecon · Wecon Levistudiou

Natnael Samson + 1 · Published 2021-08-18 · Updated 2022-02-09 · CVE-2021-23157

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WECON LeviStudioU versions 2019-09-21 and prior

Description The issue is caused by a heap-based buffer overflow in the dynamic memory of WECON LeviStudioU, which may allow a remote attacker to execute arbitrary code. This can be achieved through the exploitation of the heap-based buffer overflow vulnerability, potentially allowing for remote code execution.

Recommendations For WECON LeviStudioU versions 2019-09-21 and prior, update to a version later than 2019-09-21 to resolve the issue. As a temporary workaround, consider restricting access to the UMP file parsing functionality until a patch is available. Avoid using the ScreenInfo Tag ScrnName and ScrnFile in the UMP file parsing screen until the issue is resolved.

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

BDU:2022-05812

CVE-2021-23157

ZDI-22-130

ZDI-22-132

Affected Products

Wecon Levistudiou

References · 8

• https://osv.dev/vulnerability/CVE-2021-23157 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-132 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-23157 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-130 · Security Note
• https://bdu.fstec.ru/vul/2022-05812 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-355-03 · Note
• https://cybersecurity-help.cz/vdb/SB2022010401 · Note
• https://t.me/cibsecurity/35604 · Telegram Post