Riskcovery

CVE-2021-43083

Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response

State
Published
Severity
Not scored
Published
Dec 19, 2021
Updated
Aug 4, 2024
Reserved
Oct 30, 2021

Read the record on cve.org

Description

Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-191 Integer Underflow (Wrap or Wraparound)

Affected Products

ProductVersions
Apache PLC4XApache Software Foundation
  • PLC4C through 0.9.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.