PT-2023-14923 · Unknown · Weston Embedded Uc-Ftps

Kelly Leuschner · Published 2023-05-10 · Updated 2023-05-18 · CVE-2022-46378

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-FTPs version 1.98.00

Description An out-of-bounds read issue exists in the PORT command parameter extraction functionality. This can be triggered by a specially-crafted set of network packets, leading to denial of service. The issue occurs when no port argument is provided to the PORT command. An attacker can exploit this by sending specific packets.

Recommendations For Weston Embedded uC-FTPs version 1.98.00, consider restricting access to the PORT command until a patch is available. As a temporary workaround, ensure that a port argument is always provided to the PORT command to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-823

Related Identifiers

CVE-2022-46378

Affected Products

Weston Embedded Uc-Ftps

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681 · Exploit
• https://github.com/weston-embedded/uC-FTPs/pull/2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-46378 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46378 · Vendor Advisory
• https://t.me/cibsecurity/63813 · Telegram Post