Login Request a demo
Critical severity · published May 11, 2022
CVE-2021-33315
The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of PortID TLV, by sending a crafted lldp packet to the device, integer underflow would occur and the negative number will be passed to memcpy() later, which may cause buffer overflow or invalid memory access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Teg-30102ws Firmware · Trendnet
All versions, or not specified · source: NVD
TF
Ti-g102i Firmware · Trendnet
All versions, or not specified · source: NVD
TF
Ti-g160i Firmware · Trendnet
All versions, or not specified · source: NVD
TF
Ti-g642i Firmware · Trendnet
All versions, or not specified · source: NVD
TF
Ti-pg102i Firmware · Trendnet
All versions, or not specified · source: NVD
TF
Ti-pg1284i Firmware · Trendnet
before 2.0.2.s0 · source: NVD
TF
Ti-pg541i Firmware · Trendnet
All versions, or not specified · source: NVD
TF
Ti-rp262i Firmware · Trendnet
All versions, or not specified · source: NVD
TF
Tpe-30102ws Firmware · Trendnet
All versions, or not specified · source: NVD
Affected product
TF
Teg-30102ws Firmware
Trendnet
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33315
Patch
https://www.trendnet.com/support/view.asp?cat=4&id=81
More from Teg-30102ws Firmware
9.8
CVE-2021-33316
The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability
7.5
CVE-2021-33317
The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from a null pointer dereference vulnerability