CVE-2022-46378mediumCWE-823

CVE-2022-46378: medium-severity vulnerability in Weston Embedded uC-FTPs

Published · Updated

Follow this CVE+ Monitor uC-FTPs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.4%
In short

A flaw in the FTP server's PORT command allows an attacker to send malformed network packets that crash the service, causing it to stop working temporarily. This happens when the PORT command is sent without the required port number.

Technical detail

An out-of-bounds read vulnerability in Weston Embedded uC-FTPs v1.98.00 occurs when the PORT command is processed without a port argument, allowing a remote attacker to trigger denial of service by sending specially-crafted FTP packets. The attack requires network access to the FTP service and results in service unavailability.

Summary generated and translated by AI from the official description.
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the `PORT` command.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Weston Embedded · uC-FTPs
Related CVEs — Weston Embedded uC-FTPs

In the same product, most dangerous first.

CVE-2022-41985HIGHCVE-2022-41985EPSS 1.5%CVE-2022-46377MEDIUMCVE-2022-46377EPSS 1.5%