Vulnerability · Published May 10, 2023 · Assigned by talos
CVE-2022-46377
Medium 6.5
In plain English
A medium-severity security flaw in uC-FTPs from Weston Embedded. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.5%top 26.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no IP address argument is provided to the `PORT` command.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Weston Embedded | uC-FTPs | v 1.98.00 |
Weakness: CWE-823 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H