PT-2022-9220 · Texas Instruments · Cc3200 Simplelink Solution Nwp

Francesco Benvenuto + 1 · Published 2022-02-16 · Updated 2022-07-21 · CVE-2021-21966

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Texas Instruments CC3200 SimpleLink Solution NWP version 2.9.0.0

Description An information disclosure issue exists in the HTTP Server /ping.html functionality. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this issue.

Recommendations For Texas Instruments CC3200 SimpleLink Solution NWP version 2.9.0.0, consider disabling access to the /ping.html endpoint until a patch is available. Restricting access to this functionality can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

CWE-457

Related Identifiers

CVE-2021-21966

Affected Products

Cc3200 Simplelink Solution Nwp

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1393 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21966 · Vendor Advisory
• https://ti.com/lit/an/swra740/swra740.pdf?ts=1645536893264& · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21966 · Security Note
• https://t.me/cvenotify/26880 · Telegram Post
• https://t.me/cibsecurity/37582 · Telegram Post