Texas Instruments SimpleLink SDK RCE via Stack Buffer Overflow and Integer Overflow (CVE-2021-22677)

Critical Vulnerability Information CVSSv3 Score: 9.8 Warning: Remotely exploitable, low attack complexity Vendor: Texas Instruments Devices: SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100 Vulnerabilities: - Stack-based Buffer Overflow (CWE-121) - Integer Overflow or Wraparound (CWE-190) Risk Assessment Successful exploitation of these vulnerabilities could lead to memory corruption, remote code execution, and denial-of-service conditions. Technical Details Affected Products SimpleLink MSP432E4 SDK: v4.20.00.12 and earlier SimpleLink CC32XX SDK: v4.30.00.06 and earlier SimpleLink CC13X0 SDK: v4.10.03 and earlier SimpleLink CC13X2 SDK: v4.40.00 and earlier SimpleLink CC26XX SDK: v4.40.00 and earlier CC3200 SDK: v1.5.0 and earlier CC3100 SDK: v1.3.0 and earlier Vulnerability Overview Integer Overflow or Wraparound (CWE-190): CVE-2021-22677, CVE-2021-22675, CVE-2021-22679, CVE-2021-22671 Stack-based Buffer Overflow (CWE-121): CVE-2021-22673 Background Critical Infrastructure Sectors: Multiple sectors Deployment Countries/Regions: Global Company Headquarters Location: United States Researchers David Atch and Omri Ben Bassat (Microsoft) Mitigation Measures Upgrade to the latest software versions Connect only to trusted Wi-Fi networks Limit network exposure of all control systems, ensuring they are not directly accessible from the internet Place control system networks and remote devices behind firewalls, isolated from enterprise networks Use secure methods such as Virtual Private Networks (VPNs) when remote access is required, although note that VPNs may have vulnerabilities and should be updated to the latest versions Additional Information Visit us-cert.cisa.gov for more security recommendations and best practices for control systems

Goal Reached Thanks to every supporter — we hit 100%!

Texas Instruments SimpleLink SDK RCE via Stack Buffer Overflow and Integer Overflow (CVE-2021-22677)