PT-2022-9224 · Unknown · Seaconnect 370W

Francesco Benvenuto + 1 · Published 2022-02-04 · Updated 2022-10-01 · CVE-2021-21970

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaConnect 370W version 1.3.34

Description An out-of-bounds write issue exists in the HandleSeaCloudMessage functionality. The HandleIncomingSeaCloudMessage function uses the json object get string to populate the p name global variable. Since p name is only 0x80 bytes long and the total MQTT message could be up to 0x201 bytes, the json object get string function may fill the string based on the length of the json's value, not the actual string size, resulting in a possible out-of-bounds write.

Recommendations For SeaConnect 370W version 1.3.34, as a temporary workaround, consider restricting the length of the MQTT message to prevent out-of-bounds writes until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

CVE-2021-21970

Affected Products

Seaconnect 370W

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1396 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21970 · Security Note
• https://t.me/cvenotify/26547 · Telegram Post