{"api_version":"1","generated_at":"2026-07-24T05:00:32+00:00","cve":"CVE-2021-32994","urls":{"html":"https://cve.report/CVE-2021-32994","api":"https://cve.report/api/cve/CVE-2021-32994.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-32994","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-32994"},"summary":{"title":"CVE-2021-32994","description":"Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.","state":"PUBLIC","assigner":"ics-cert@hq.dhs.gov","published_at":"2022-04-04 20:15:00","updated_at":"2022-04-13 13:25:00"},"problem_types":["CWE-119"],"metrics":[],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-168-02","name":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-168-02","refsource":"CONFIRM","tags":[],"title":"Softing OPC-UA C++ SDK | CISA","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32994","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32994","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Eran Jacob of OTORIO reported this vulnerability to CISA.","lang":""}],"nvd_cpes":[{"cve_year":"2021","cve_id":"32994","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"softing","cpe5":"opc_ua_c\\+\\+_software_development_kit","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2021-32994","STATE":"PUBLIC","TITLE":"Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"OPC UA C++ SDK (Software Development Kit)","version":{"version_data":[{"version_affected":"<","version_name":"5.59","version_value":"5.64"}]}}]},"vendor_name":"Softing"}]}},"credit":[{"lang":"eng","value":"Eran Jacob of OTORIO reported this vulnerability to CISA."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}]},"references":{"reference_data":[{"name":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-168-02","refsource":"CONFIRM","url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-168-02"}]},"solution":[{"lang":"eng","value":"Softing has released version 5.65 to address this vulnerability and has notified known users of the release. As this vulnerability only affects the publisher and subscriber protocol, Softing highly recommends customers using this protocol to upgrade to the latest version or disable the functionality. Please download the latest software package from the Softing website. "}],"source":{"advisory":"ICSA-21-166-02","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2022-04-04 20:15:00","lastModifiedDate":"2022-04-13 13:25:00","problem_types":["CWE-119"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:softing:opc_ua_c\\+\\+_software_development_kit:*:*:*:*:*:*:*:*","versionStartIncluding":"5.59.0","versionEndExcluding":"5.65.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"32994","Ordinal":"208384","Title":"CVE-2021-32994","CVE":"CVE-2021-32994","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"32994","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}