CVE-2021-21966 Information disclosure in Texas Instruments
An attacker can send a crafted HTTP request to the CC3200 SimpleLink HTTP server to trigger an uninitialized read, potentially disclosing sensitive memory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21966?
CVE-2021-21966 is a medium-severity vulnerability in Texas Instruments, published on 16 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this vulnerability.
Which versions are affected by CVE-2021-21966?
It affects 3 products.
Products include Ti Cc3100 Firmware, Ti Cc3200 Firmware, Ti Simplelink Cc32xx Software Development Kit.
How do I fix CVE-2021-21966?
No fix has been published for CVE-2021-21966 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21966 being exploited?
There is no known exploitation of CVE-2021-21966 in the wild and no public exploit code.
Sources
Also known as GHSA-3786-v5g9-6834.