CVE-2022-21209

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
FATEK Automation	FvDesigner	>= all, <= 1.5.100

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-055-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-435/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-436/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-439/Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-055-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-435/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-436/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-439/Third Party Advisory, VDB Entry

Timeline

Published: Feb 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21216.5OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a CVE-2022-212108.8An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP req CVE-2022-212117.5This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is no CVE-2022-212126.5Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of CVE-2022-212137.5This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn CVE-2022-212147.8The affected product is vulnerable to a heap-based buffer overflow, which may lead to code execution.CVE-2022-212159.8This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are CVE-2022-212166.8Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a pr CVE-2022-212179.8An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-craft CVE-2022-212185.5Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable CVE-2022-212197.8Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause in CVE-2022-21227.8DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which ca