CVE-2021-38442

Summary

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a heap-corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.

Affected Software

Weaknesses

• CWE-119: IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119

Workarounds

FATEK Automation has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of these affected products are invited to contact FATEK customer support for additional information.

ADP Enrichment

CVE Program Container

Additional References

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06

References

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06

• ←Previous
• Next→