CVE-2021-43083CWE-119CWE-191

Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response

published December 19, 2021

CVSS
—
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01985 · 80.4th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2021-12-19T08:25Z
EPSS history
Timeline
  • 19 DEC 08:25Z
    Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response
    cvelistv5