A vulnerability has been found in Siretta QUARTZ-GOLD G5.0.1.5-210720-141020 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Network Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This buffer overflow is in the function that manages the 'vpn l2tp advanced name WORD dns (yes|no) mtu mru auth (on|off) password (WORD|null) options WORD' command template.

The weakness was released 01/27/2023 as TALOS-2022-1613. It is possible to read the advisory at talosintelligence.com. This vulnerability is known as CVE-2022-41021 since 09/19/2022. The technical details are unknown and an exploit is not publicly available.

Applying a patch is able to eliminate this problem.

Productinfo

Vendor

• Siretta

Name

• QUARTZ-GOLD

Version

• G5.0.1.5-210720-141020

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion