CVE-2021-23157

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
WECON	LeviStudioU	>= All, <= 2019-09-21

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-03Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-130/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-132/Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-03Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-130/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-132/Third Party Advisory, VDB Entry

Timeline

Published: Jan 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-231589.8A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what-where condition, all CVE-2021-231595.5A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is CVE-2021-23168.1Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected ar CVE-2021-231628.1Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command C CVE-2021-231638.8JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issu CVE-2021-231659.8A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary co CVE-2021-231668.7A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and w CVE-2021-231676.8Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Comm CVE-2021-231686.5Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enab CVE-2021-231698.8A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to CVE-2021-231710.0Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supp CVE-2021-231725.5A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitab