CVE-2021-27417
Medium
Published: 03 May 2022
Published
03 May 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1
4.6
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:H
EPSS Score
0.0018
39.7th percentile
Risk Priority
9
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2021-27417 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Ecoscentric Ecospro. Its CVSS base score is 4.6 (Medium).
Operationally, ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-14171
Vulnerability details
eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
ecoscentric
ecospro
2.0.1 — 4.5.3
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.