CVE-2021-31401

Katalog CVE

CVSS 7.5 · High EPSS 2,3%

Kerentanan Improper Input Validation pada hcc-embedded nichestack, siemens sentron 3wl com35 firmware +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.

Rincian

Terbit di NVD

19 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf mitigasi · advisory pihak ketiga
• https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ mitigasi · advisory pihak ketiga
• https://www.kb.cert.org/vuls/id/608209 advisory pihak ketiga · pemerintah AS