Skip to content
fr Sign in
3.7 Low

CVE-2021-21970 An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc

Description

An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [3] the json_object_get_string to populate the p_name global variable. The p_name is only 0x80 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write.

Affected products and versions

Product Affected versions Fixed in
Sealevel Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Sealevel

The 10 CVEs of Sealevel →
CVE-2021-21962 A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc 9.0 Critical CVE-2021-21968 A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc 8.1 High CVE-2021-21959 A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc 7.7 High CVE-2021-21965 A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc 8.6 High
Track this CVE