CVEvulnerability
CVE-2021-27417
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-05-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.6 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-190
Description
eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.
Affected configurations
• ecoscentric ecospro (>= 2.0.1 <= 4.5.3)
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437 Permissions Required, Vendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 Third Party Advisory, US Government Resource
- https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437 Permissions Required, Vendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 Third Party Advisory, US Government Resource