CVE-2021-21906: garrett ic module cma

csirt@kutim:~/threat-intel/cve/CVE-2021-21906

CVSS 7.2 · High EPSS 0,97%

Kerentanan Stack-based Buffer Overflow pada garrett ic module cma. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locations. The Garrett iC Module exposes an authenticated CLI over TCP port 6877. This interface is used by a secondary GUI client, called “CMA Connect”, to interact with the iC Module on behalf of the user. Every time a user submits a password to the CLI password prompt, the buffer containing their input is passed as the password parameter to the checkPassword function.

Rincian

Terbit di NVD: 22 Desember 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-121: Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write
EPSS (30 hari): 0,97% peluang dieksploitasi; lebih tinggi dari 61,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
garrett	ic module cma	Versi 5.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1357 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.