CVE-2021-36762
highpriority · track · 31stack campaign · INFRA:HALTEPSS 0.023 · 83 %ileEURUUSEPSS · scored 2026-10-27
An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processing function doesn't ensure that a filename is adequately '\0' terminated; therefore, a subsequent call to strlen for the filename might read out of bounds of the protocol packet buffer (if no '\0' byte exists within a reasonable range).
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedInterNiche stackcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf - FixedNicheLitecisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-21-217-01HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B)2021-08-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://us-cert.cisa.gov/ics/advisories/icsa-21-217-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2661cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021080607cnnvd
- https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/cnnvd
- https://www.hcc-embedded.com/about/about-internichecnnvd
- https://www.kb.cert.org/vuls/id/608209cnnvd
- https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/enisa_euvd
- https://www.hcc-embedded.com/about/about-internicheenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan