CVE-2021-38487

Potential Network Amplification and Information Exposure in RTI Connext Professional and Connext Micro

State: Published
Severity: 8.8 High
Published: May 5, 2022
Updated: Jun 23, 2025
Reserved: Aug 10, 2021

Description

RTI Connext Professional versions 4.1 to 6.1.0, and Connext Micro versions 2.4 and later are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic. This may result in a denial-of-service condition and information exposure.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N	RTI
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	RTI

Weaknesses

CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

Affected Products

Product	Versions
Connext ProfessionalRTI	4.1 to before 6.1.0Affected
Connext MicroRTI	4.0.0 to before 4.0.Affected 3.0.0 to before 3.0.Affected 2.4.0 to before 2.4.*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.