CVE-2021-23157: WECON LeviStudioU UMP File Parsing ScreenInfo Tag ScrnName Heap-based Buffer Overflow Remote Code Execution Vulnerability
First published: Fri Jan 14 2022(Updated: )
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WECON LeviStudioU. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ScreenInfo tags within UMP files. When parsing the ScrnFile attribute, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| We-con Levistudiou | <=2019-09-21 | |
| WECON LeviStudioU | ||
| WECON LeviStudioU: Versions 2019-09-21 and prior |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this WECON LeviStudioU vulnerability?
The vulnerability ID of this WECON LeviStudioU vulnerability is CVE-2021-23157.
What is the severity of CVE-2021-23157?
The severity of CVE-2021-23157 is high with a CVSS score of 7.8.
How can remote attackers exploit CVE-2021-23157?
Remote attackers can exploit CVE-2021-23157 by enticing the target to visit a malicious page or open a malicious file.
What software is affected by CVE-2021-23157?
WECON LeviStudioU versions up to and including 2019-09-21 are affected by CVE-2021-23157.
Is user interaction required to exploit CVE-2021-23157?
Yes, user interaction is required to exploit CVE-2021-23157.
- collector/nvd-index
- agent/type
- agent/title
- agent/weakness
- agent/references
- agent/author
- agent/description
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-22-130
- alias/ZDI-CAN-14576
- alias/CVE-2021-23157
- alias/ZDI-22-132
- alias/ZDI-CAN-14584
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/we-con
- canonical/we-con levistudiou
- version/we-con levistudiou/2019-09-21
- vendor/wecon
- canonical/wecon levistudiou: versions 2019-09-21 and prior
- canonical/wecon levistudiou