CVE-2021-21966

MEDIUM
Published Feb 16, 20224y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Feb 16, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this vulnerability.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 2

CWE-457
CWE-908

Affected Products 15

VendorProductVersionRange
tisimplelink_cc32xx_software_development_kit* <5.30.00.08
ticc3120*any
ticc3130*any
ticc3135*any
ticc3220r*any
ticc3220s*any
ticc3220sf*any
ticc3230s*any
ticc3230sf*any
ticc3235s*any
ticc3235sf*any
ticc3100_firmware* <1.0.1.15-2.15.0.1
ticc3100*any
ticc3200_firmware* <1.0.1.15-2.15.0.1
ticc3200*any

References 2

  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2021-1393
    ExploitThird Party Advisory
  • ti.com https://www.ti.com/lit/an/swra740/swra740.pdf?ts=1645536893264&
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.