CVE-2021-21783 Integer overflow in Genivia
A remote attacker can execute arbitrary code by sending a specially crafted SOAP request to applications using the gSOAP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21783?
CVE-2021-21783 is a critical vulnerability in Oracle Communications Diameter Signaling Router, published on 25 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
Which versions are affected by CVE-2021-21783?
It affects 6 products.
Products include Genivia Gsoap, Oracle Communications Diameter Signaling Router, Oracle Communications Eagle Application Processor, Oracle Communications Eagle Lnp Application Processor, Oracle Communications Lsms, Oracle Tekelec Virtual Operating Environment.
How do I fix CVE-2021-21783?
No fix has been published for CVE-2021-21783 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21783 being exploited?
There is no known exploitation of CVE-2021-21783 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Diameter Signaling Router
- CVE-2019-25355 Genivia gSOAP 2.8 - 'gSOAP' Path Traversal
- CVE-2017-9765 Integer overflow in n/a
- CVE-2019-6973 Denial of service in n/a
All Oracle Communications Diameter Signaling Router vulnerabilities
Sources
Also known as DEBIAN-CVE-2021-21783, GHSA-pf2j-vqc7-8qr7, UBUNTU-CVE-2021-21783.