CVE Vulnerability

CVE-2021-38451

The affected product’s proprietary protocol CSC allows for calling numerous function codes. In order to call those function codes, the user must supply parameters. There is no sanitation on the value of the offset, which allows the client to specify any offset and read out-of-bounds data.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.7 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:auvesy:versiondog:*:*:*:*:*:*:*:*
Information

Published : 2021-10-22 12:15

Updated : 2021-10-27 03:06

NVD link : CVE-2021-38451

Mitre link : CVE-2021-38451

Products Affected
No products.
CWE
CWE-125

Out-of-bounds Read