CVE-2021-45117

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cert-portal.siemens.com/productcert/pdf/ssa-285795.pdfPatch, Third Party Advisory
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-45117.pdfPatch, Vendor Advisory
https://www.youtube.com/watch?v=qv-RBdCaV4kExploit, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-285795.pdfPatch, Third Party Advisory
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-45117.pdfPatch, Vendor Advisory
https://www.youtube.com/watch?v=qv-RBdCaV4kExploit, Third Party Advisory

Timeline

Published: Mar 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-452228.8An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privi CVE-2021-452236.5An issue was discovered in COINS Construction Cloud 11.12. Due to insufficient input neutralization, it is vulnerable to denial of service a CVE-2021-452246.1An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a U CVE-2021-452256.1An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization, it is vulnerable to reflected cross-site sc CVE-2021-452266.5An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause i CVE-2021-452275.4An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionalit CVE-2021-452285.4An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task CVE-2021-452296.1It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affec CVE-2021-452306.5In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create D CVE-2021-452317.8A link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security CVE-2021-452329.8In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `CVE-2021-452529.8Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_to