CVE-2022-46378

Weston Embedded uC-FTPs v1.98.00 has an out-of-bounds read in the PORT command parameter extraction. When PORT is issued with no arguments, the server may scan the input and access unmapped memory, causing a denial of service. Talos’ TALOS-2022-1681 report (CVE-2022-46378; CVE-2022-46377) confirm...

CVE-2022-46377

Weston Embedded uC-FTPs 1.98.00 has an out-of-bounds read in the PORT command argument extraction. When no IP address argument is provided to PORT, the server may misparse the buffer, potentially leading to denial of service. Concrete details in Talos/TALOS-2022-1681 describe the vulnerable code ...

CVE-2022-41985

CVE-2022-41985 affects Weston Embedded uC-FTPs v1.98.00. Talos reports an authentication bypass in the FTP server: after USER with an unauthenticated sequence, the state machine can skip authentication and allow following commands, potentially enabling DoS via crafted packets. Evidence from Talos...