Vulnerability · Published Dec 29, 2021 · Assigned by INCD

CVE-2021-36724ForeScout - SecureConnector Local Service DoS

Medium 6.1

In plain English

A medium-severity security flaw in eServices / eNvoice from ForeScout. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash.

Affected products (as reported)

Vendor	Product	Versions
ForeScout	eServices / eNvoice	SecureConnector 11.0.4.1024

References

https://www.gov.il/en/departments/faq/cve_advisories x_refsource_CONFIRM