CVE-2021-37604

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Always-Incorrect Control Flow Implementation pada microchip miwi. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters being validated/updated prior to the message authentication. With this vulnerability in place, an attacker may increment the incoming frame counter values by injecting messages with a sufficiently large frame counter value and invalid payload. This results in denial of service/valid packets in the network. There is also a possibility of a replay attack in the stack.

Rincian

Terbit di NVD

5 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-670: Always-Incorrect Control Flow Implementation

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf release notes · advisory vendor
• https://www.microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced... advisory vendor
• https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-v... advisory vendor
• https://www.microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol advisory vendor
• https://www.microchip.com/product-change-notifications/#/ advisory vendor