CVE-2021-40526 Memory corruption in n/a
Remote attackers can cause a denial of service on Peleton Bikes by triggering a heap overflow in the GymKit daemon, preventing device authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40526?
CVE-2021-40526 is a medium-severity memory corruption vulnerability in n/a, published on 25 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike
Weakness: CWE-131
Which versions are affected by CVE-2021-40526?
It affects 1 product.
Products include Onepeloton Ttr01 Firmware.
How do I fix CVE-2021-40526?
No fix has been published for CVE-2021-40526 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-40526 being exploited?
There is no known exploitation of CVE-2021-40526 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jvqh-h8m5-xc3q.