CVE-2021-32020

highpriority · track · 39EPSS 0.013 · 70 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.30% (70th) EPSS
CVSS 7.5 · high
Is it mine?
17 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · nvd · sick_psirt

EPSS · scored 2026-10-27

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a workaround is available.

  • WorkaroundSICK CDE-100 all Firmware versionssick_psirt

    SICK is still investigating if the CDE-100 is affected by this vulnerability. Please make sure that you apply general security practices when operating the CDE-100 like network segmentation. The following General Security Practices and Operating Guidelines could mitigate the associated security risk.

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · SICK PSIRT DE
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-119USprimaryCWE-119US
04

affected products (17)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SCA-2024-0004Third party vulnerabilities in SICK CDE-1002024-11-07csaf · sick_psirtDE

    The SICK CDE-100 uses the open-source libraries FreeRTOS, lwIP and MCU Boot. The used libraries contain vulnerabilities that affect the SICK CDE-100.

  • SCA-2025-0003FreeRTOS Vulnerabilities have no impact on SICK Products2025-02-28csaf · sick_psirtDE

    FreeRTOS has several known vulnerabilities and is used in various SICK products. A current analysis confirms that the identified vulnerabilities in FreeRTOS do not affect the mentioned SICK products. At this time, there is no indication of any potential risks to these SICK products.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdnvdsick_psirtNVDCVE.orgMITRE
published 2021-05-03modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan