Multiple vulnerabilities in Garrett Metal Detectors iC Module CMA
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 9 |
| CVE-ID | CVE-2021-21903 CVE-2021-21907 CVE-2021-21909 CVE-2021-21908 CVE-2021-21902 CVE-2021-21901 CVE-2021-21906 CVE-2021-21905 CVE-2021-21904 |
| CWE-ID | CWE-121 CWE-22 CWE-303 CWE-119 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Garrett Metal Detectors iC Module CMA Hardware solutions / Other hardware appliances |
| Vendor | Garrett Metal Detectors |
Security Bulletin
This security bulletin contains information about 9 vulnerabilities.
1) Stack-based buffer overflow
EUVDB-ID: #VU59087
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21903
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing UDP packets in the check_udp_crc() function of the CMA Connect software for Garrett PD 6500i and Garrett MZ 6100 models. A remote attacker can specially crafted packets to port 6877/UDP, trigger stack-based buffer overflow and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1355
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Path traversal
EUVDB-ID: #VU59334
Risk: Low
CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21907
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in the CMA CLI getenv command functionality. A remote administrator can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://talosintelligence.com/vulnerability_reports/TALOS-2021-1358
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Path traversal
EUVDB-ID: #VU59333
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21909
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in in the del .cnt|.log file delete command. A remote administrator can send a specially crafted HTTP request and delete arbitrary files on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://talosintelligence.com/vulnerability_reports/TALOS-2021-1359
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Path traversal
EUVDB-ID: #VU59332
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21908
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in "file" parameter in the handle_delete function. A remote administrator can send a specially crafted HTTP request and delete arbitrary files on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://talosintelligence.com/vulnerability_reports/TALOS-2021-1359
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Incorrect Implementation of Authentication Algorithm
EUVDB-ID: #VU59331
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21902
CWE-ID:
CWE-303 - Incorrect Implementation of Authentication Algorithm
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to to bypass authentication process.
The vulnerability exists due to incorrect implementation of authentication algorithm in the CMA run_server_6877 functionality. A remote attacker can send a specially crafted request and bypass the authentication.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://talosintelligence.com/vulnerability_reports/TALOS-2021-1354
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Buffer overflow
EUVDB-ID: #VU59330
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21901
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the CMA check_udp_crc function. A remote attacker can send a specially crafted packet, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://talosintelligence.com/vulnerability_reports/TALOS-2021-1353
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Stack-based buffer overflow
EUVDB-ID: #VU59329
Risk: Low
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21906
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the "checkPassword" CMA readfile function. A remote administrator can use a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://talosintelligence.com/vulnerability_reports/TALOS-2021-1357
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Stack-based buffer overflow
EUVDB-ID: #VU59328
Risk: Low
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21905
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the "get_ip" CMA readfile function. A remote administrator can use a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://talosintelligence.com/vulnerability_reports/TALOS-2021-1357
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Path traversal
EUVDB-ID: #VU59088
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21904
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing CLI setenv command arguments. A local user can run a specially crafted command to overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to escalate privileges on the system.
Install update from vendor's website.
Vulnerable software versionsGarrett Metal Detectors iC Module CMA: 5.0
External linkshttp://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1356
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
