PT-2023-14922 · Unknown · Weston Embedded Uc-Ftps

Kelly Leuschner · Published 2023-05-10 · Updated 2023-05-18 · CVE-2022-46377

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-FTPs version 1.98.00

Description An out-of-bounds read issue exists in the PORT command parameter extraction functionality. A specially-crafted set of network packets can lead to denial of service. This occurs when no IP address argument is provided to the PORT command. An attacker can send packets to trigger this issue.

Recommendations For Weston Embedded uC-FTPs version 1.98.00, consider restricting access to the PORT command until a patch is available. As a temporary workaround, ensure that an IP address argument is always provided to the PORT command to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-823

Related Identifiers

CVE-2022-46377

Affected Products

Weston Embedded Uc-Ftps

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681 · Exploit
• https://github.com/weston-embedded/uC-FTPs/pull/2 · Patch
• https://osv.dev/vulnerability/CVE-2022-46377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46377 · Security Note
• https://t.me/cibsecurity/63803 · Telegram Post