CVE-2021-38434

Summary

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an unexpected sign extension. An attacker could leverage this vulnerability to execute arbitrary code.

Affected Software

Weaknesses

• CWE-194: UNEXPECTED SIGN EXTENSION CWE-194

Workarounds

FATEK Automation has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of these affected products are invited to contact FATEK customer support for additional information.

ADP Enrichment

CVE Program Container

Additional References

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06

References

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06

• ←Previous
• Next→