CVE-2021-43554

The CVE-2021-43554 issue affects Fatek Automation WinProladder (versions 3.30_24518 and earlier) and stems from an out-of-bounds write during PDW file parsing. ZDI advisories describe a remote code execution vulnerability (CWE-787) with a write before the start or before the allocated buffer, exp...

CVE-2021-43556

CVE-2021-43556 affects FATEK WinProladder: versions 3.30_24518 and earlier are vulnerable to a stack-based buffer overflow while processing project files (SPF/TAB/PDW variants, per ZDI advisories). The root cause is improper validation of the length of user-supplied data copied into a stack buffe...

CVE-2021-38430

CVE-2021-38430 affects FATEK Automation WinProladder, version 3.30 and prior. The root cause is improper validation of user-supplied data when parsing project files (PDW), enabling a stack-based buffer overflow. Exploitation could lead to arbitrary code execution. The ZDI advisory notes this can ...

CVE-2020-16234

CVE-2020-16234Targets PLC WinProladder, version 3.28 and earlier. A stack-based buffer overflow in the software can be triggered by opening a specially crafted file, with the potential to remotely execute arbitrary code. Public documentation lists CVSS v3 base score 7.8 (high) with LOCAL/LOW comp...

CVE-2021-32992

CVE-2021-32992 concerns FATEK Automation WinProladder; versions 3.30 and earlier are affected by improper restriction of operations within the bounds of a memory buffer. The root cause is out-of-bounds memory handling (CWE-119) leading to potential arbitrary code execution. Affected product: WinP...

CVE-2021-38434

CVE-2021-38434 affects FATEK Automation WinProladder (versions 3.30 and prior). The connected sources describe a vulnerability in parsing project files where user-supplied data is not properly validated, leading to an unexpected sign extension that could enable arbitrary code execution. Public ad...

CVE-2021-38426

FATEK WinProladder (versions 3.30 and prior) is affected by CVE-2021-38426 due to improper validation of user-supplied data when parsing project files, causing an out-of-bounds write. The vulnerability can lead to arbitrary code execution. Public exploitation details are provided by ZDI-21-1169, ...

CVE-2021-38438

This CVE-2021-38438 affects FATEK Automation WinProladder (versions 3.30 and earlier). The vulnerability is a use-after-free in the PDW/project file parsing, which may be triggered when a valid user opens a malformed project file and can lead to arbitrary code execution. The issue is described ac...

CVE-2021-38436

FATEK Automation WinProladder is affected (versions 3.30 and prior). The issue arises from a lack of proper validation of user-supplied data when parsing project files, leading to memory corruption that could enable arbitrary code execution in the current process. The CVE is tracked as CVE-2021-3...

CVE-2021-32990

CVE-2021-32990 concerns FATEK Automation WinProladder, affected in versions up to 3.30, with an out-of-bounds read that may allow arbitrary code execution. Multiple sources confirm this vulnerability class and impact; CVSS scores indicate high/critical risk (network attack with low complexity). T...

CVE-2021-38442

CVE-2021-38442 affects FATEK Automation WinProladder, with vulnerable PDW/PLC configuration data handling in WinProladder versions 3.30 and earlier. The root cause, as described across multiple sources, is improper validation of user-supplied data during PDW file parsing, leading to memory corrup...

CVE-2021-32988

CVE-2021-32988 affects FATEK Automation WinProladder, vulnerable in Versions 3.30 and earlier due to an out-of-bounds write. This flaw can allow an attacker to execute arbitrary code. The issue is part of a broader set of WinProladder memory-buffer related vulnerabilities (also noted as out-of-bo...

CVE-2021-27486

FATEK Automation WinProladder (versions 3.30 and prior) is affected by CVE-2021-27486 due to an integer underflow (CWE-191) that can cause an out-of-bounds write and allow arbitrary code execution. The issue is specific to the WinProladder PLC software; the Red Hat and other CVE records corrobora...

CVE-2021-38440

FATEK Automation WinProladder (PDW parsing) is affected by CVE-2021-38440: an out-of-bounds read in WinProladder versions 3.30 and earlier can disclose unauthorized information. The vulnerability exists in parsing PDW files and may be exploited by remote attackers. Exploitation requires user inte...