CVE-2021-27417

critical

Description

eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04

https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04

https://www.tenable.com/cyber-exposure/2021-threat-landscape-retrospective

https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437

Details

Source: Mitre, NVD

Published: 2022-05-03

Updated: 2026-06-17

Named Vulnerability: BadAlloc

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00085