CVE-2021-40142

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cert-portal.siemens.com/productcert/pdf/ssa-321292.pdfPatch, Third Party Advisory
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-40142.pdfPatch, Vendor Advisory
https://opcfoundation.org/security-bulletins/Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-321292.pdfPatch, Third Party Advisory
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-40142.pdfPatch, Vendor Advisory
https://opcfoundation.org/security-bulletins/Vendor Advisory

Timeline

Published: Aug 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-401438.2Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attac CVE-2021-401457.5gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 im CVE-2021-401469.8A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5.CVE-2021-401479.8EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198.CVE-2021-401487.5In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure CVE-2021-401495.9The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attac CVE-2021-40154.3firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-401507.5The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly acc CVE-2021-401538.1squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create CVE-2021-401545.5NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of U CVE-2021-401557.8A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing CVE-2021-401567.8A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated boundaries when parsing