Lucene search

[email protected]CVE-2021-33000

HistoryJun 24, 2021 - 6:15 p.m.

CVE-2021-33000

2021-06-2418:15:08

CWE-787

CWE-122

[email protected]

web.nvd.nist.gov

cve-2021-33000

buffer overflow

code execution

webaccess hmi designer

security vulnerability

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.007 Low

EPSS

Percentile

79.6%

JSON

Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).

Affected configurations

NVD

Node

advantechwebaccess\/hmi_designerRange≤2.1.9.95

CPENameOperatorVersion
advantech:webaccess\/hmi_designeradvantech webaccess/hmi designerle2.1.9.95

CPE	Name	Operator	Version
advantech:webaccess\/hmi_designer	advantech webaccess/hmi designer	le	2.1.9.95

CNA Affected

[
  {
    "product": "WebAccess HMI Designer",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "versions 2.1.9.95 and prior"
      }
    ]
  }
]