Vulnerability · Published Jan 27, 2021 · Assigned by icscert
CVE-2021-22639
High 7.8
In plain English
A high-severity security flaw in Tellus Lite V-Simulator and V-Server Lite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.9%top 19.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Tellus Lite V-Simulator and V-Server Lite | Versions prior to 4.0.10.0 |
Weakness: CWE-824
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-026-01 x_refsource_MISC
- https://www.zerodayinitiative.com/advisories/ZDI-21-098/ x_refsource_MISC