First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2021-44479

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Programming (ISP) mode. This discloses protected flash memory.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Xen1thLabs-AE/CVE-2021-40154Third Party Advisory
https://www.darkmatter.ae/xen1thlabs/published-advisories/Broken Link, Third Party Advisory
https://github.com/Xen1thLabs-AE/CVE-2021-40154Third Party Advisory
https://www.darkmatter.ae/xen1thlabs/published-advisories/Broken Link, Third Party Advisory

Timeline

Published: Dec 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-44489.8The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insuf CVE-2021-444808.1Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surro CVE-2021-444817.5An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of parameter validation in calls to memcpy in check_and_set_timeout in CVE-2021-444827.5An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to do_verify in sr_unix/do_verify.c allow CVE-2021-444837.5An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to eb_div in sr_port/eb_muldiv.c allows a CVE-2021-444847.5An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in calls to emit_trip in sr_port/emit_code.c allows att CVE-2021-444857.5An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in trip_gen in sr_port/emit_code.c allows attackers to CVE-2021-444869.8An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can manipulate the value of a function pointer CVE-2021-444877.5An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in calls to ious_open in sr_unix/ious_open.c allows att CVE-2021-444889.1An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can control the size and input to calls to mem CVE-2021-444897.5An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause an integer underflow of the size of CVE-2021-44499.8The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in