Vulnerability · Published Dec 19, 2021 · Assigned by apache

CVE-2021-43083Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response

High 8.8

In plain English

A high-severity memory corruption in Apache PLC4X from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)2.0%top 19.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache PLC4X	PLC4C – through 0.9.0

Weakness: CWE-119, CWE-191

References

https://lists.apache.org/thread/jxx6qc84z60xbbhn6vp2s5qf09psrtc7 x_refsource_MISC
[oss-security] 20211220 CVE-2021-43083: Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response mailing-list, x_refsource_MLIST