CVE-2021-43083: falha em Apache PLC4X
Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.0%
Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.
Produtos afetados
Apache Software Foundation · Apache PLC4XCVEs relacionadas — Apache PLC4X
No mesmo produto, das mais perigosas para as menos.
CVE-2026-102509HIGHApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserEPSS 0.4%CVE-2026-102510HIGHApache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengthsEPSS 0.3%CVE-2026-102511HIGHApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themEPSS 0.2%CVE-2026-102508CRITICALApache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeEPSS 0.2%