Buffer overflow in Apache Plc4x
CVE-2021-43083
Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.
Vulnerability class: Buffer Overflow
EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Plc4x
- Apache Software Foundation Plc4x — versions PLC4C
Weakness classification (CWE)
References
- security@apache.org (x_refsource_MISC, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-43083?
- CVE-2021-43083 is a high-severity vulnerability in Apache Plc4x, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2021-12-19.
- How severe is CVE-2021-43083?
- High severity. CVSS v3 base score is 8.8 out of 10.