CVE-2022-46378

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-FTPs version 1.98.00

Description An out-of-bounds read issue exists in the PORT command parameter extraction functionality. This can be triggered by a specially-crafted set of network packets, leading to denial of service. The issue occurs when no port argument is provided to the PORT command. An attacker can exploit this by sending specific packets.

Recommendations For Weston Embedded uC-FTPs version 1.98.00, consider restricting access to the PORT command until a patch is available. As a temporary workaround, ensure that a port argument is always provided to the PORT command to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.