PT-2022-10226 · Trendnet · Trendnet Ti-Pg1284I

Qian Chen · Published 2022-05-11 · Updated 2022-07-12 · CVE-2021-33315

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TRENDnet TI-PG1284i switch (hw v2.0R) versions prior to 2.0.2.S0

Description The issue exists in the lldp related component of the switch due to a lack of proper validation on the length field of PortID TLV. By sending a crafted lldp packet to the device, an integer underflow would occur, and a negative number will be passed to memcpy() later, which may cause buffer overflow or invalid memory access.

Recommendations For versions prior to 2.0.2.S0, update to version 2.0.2.S0 or later to resolve the issue. As a temporary workaround, consider restricting access to the lldp related component to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-33315

Affected Products

Trendnet Ti-Pg1284I

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-33315 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33315 · Vendor Advisory
• https://trendnet.com/support/view.asp?cat=4&id=81 · Vendor Advisory
• https://t.me/cibsecurity/42412 · Telegram Post