CVE-2021-32198
Last modified
CVE-2021-32198 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service (Windows GUI hang) by telling the ZOC window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.. EPSS estimates a 1.15% chance of exploitation in the next 30 days.
Description
EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service (Windows GUI hang) by telling the ZOC window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Emtec | Zoc | <= 8.02.4 |
References
- http://www.emtec.com/downloads/zoc/zoc_changes.txtRelease Notes, Vendor Advisory
- https://pastebin.com/0xhrDvW0Third Party Advisory
- http://www.emtec.com/downloads/zoc/zoc_changes.txtRelease Notes, Vendor Advisory
- https://pastebin.com/0xhrDvW0Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-32198?
How severe is CVE-2021-32198?
How do I fix CVE-2021-32198?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-32159A Cross-site request forgery (CSRF) vulnerability exists in …8.8
- CVE-2021-32160A Cross-Site Scripting (XSS) vulnerability exists in Webmin …6.1
- CVE-2021-32161A Cross-Site Scripting (XSS) vulnerability exists in Webmin …6.1
- CVE-2021-32162A Cross-site request forgery (CSRF) vulnerability exists in …8.8
- CVE-2021-32163Authentication vulnerability in MOSN v.0.23.0 allows attacke…9.8
- CVE-2021-32172Maian Cart v3.8 contains a preauthorization remote code exec…9.8
- CVE-2021-32202In CS-Cart version 4.11.1, it is possible to induce copy-pas…6.1
- CVE-2021-3223Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f dir…7.5
- CVE-2021-32233SmarterTools SmarterMail before Build 7776 allows XSS.6.1
- CVE-2021-32234SmarterTools SmarterMail 16.x through 100.x before 100.0.780…9.8
- CVE-2021-32238Epic Games / Psyonix Rocket League <=1.95 is affected by Buf…7.8
- CVE-2021-3224A stored cross-site scripting (XSS) vulnerability in cszcms …5.4
Are you affected by CVE-2021-32198?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST