Sharp NEC UN462A HTTP Request buffer overflow

Summaryinfo

A vulnerability was found in Sharp NEC UN462A, UN462VA, UN492S, UN492VS, UN552A, UN552S, UN552VS, UN552, UN552V, UX552S, UN552, V864Q, C861Q, P754Q, V754Q, C751Q, V964Q, C961Q, P654Q, V654Q, C651Q and V554Q. It has been classified as critical. Affected by this issue is some unknown functionality of the component HTTP Request Handler. This manipulation causes buffer overflow. The identification of this vulnerability is CVE-2021-20699. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in Sharp NEC UN462A, UN462VA, UN492S, UN492VS, UN552A, UN552S, UN552VS, UN552, UN552V, UX552S, UN552, V864Q, C861Q, P754Q, V754Q, C751Q, V964Q, C961Q, P654Q, V654Q, C651Q and V554Q. Affected by this vulnerability is an unknown code block of the component HTTP Request Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Sharp NEC Displays ((UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to it, UX552S R1.300 and prior to it, UX552 R1.300 and prior to it, V864Q R2.000 and prior to it, C861Q R2.000 and prior to it, P754Q R2.000 and prior to it, V754Q R2.000 and prior to it, C751Q R2.000 and prior to it, V984Q R2.000 and prior to it, C981Q R2.000 and prior to it, P654Q R2.000 and prior to it, V654Q R2.000 and prior to it, C651Q R2.000 and prior to it, V554Q R2.000 and prior to it, P404 R3.200 and prior to it, P484 R3.200 and prior to it, P554 R3.200 and prior to it, V404 R3.200 and prior to it, V484 R3.200 and prior to it, V554 R3.200 and prior to it, V404-T R3.200 and prior to it, V484-T R3.200 and prior to it, V554-T R3.200 and prior to it, C501 R2.000 and prior to it, C551 R2.000 and prior to it, C431 R2.000 and prior to it) allows an attacker a buffer overflow and to execute remote code by sending long parameters that contains specific characters in http request.

The weakness was shared 06/07/2021. It is possible to read the advisory at sharp-nec-displays.com. This vulnerability is known as CVE-2021-20699. The technical details are unknown and an exploit is not publicly available.

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Sharp NEC

Name

• C651Q
• C751Q
• C861Q
• C961Q
• P654Q
• P754Q
• UN462A
• UN462VA
• UN492S
• UN492VS
• UN552
• UN552
• UN552A
• UN552S
• UN552V
• UN552VS
• UX552S
• V554Q
• V654Q
• V754Q
• V864Q
• V964Q

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion