attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is high; availability impact is high.
Affected products
HMS Networks PEAK-System Device Driver Setup and HMS Networks PCAN Windows CAN device drivers
Classified as
CWE-129 (Improper Validation of Array Index)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
HMS Networks
PEAK-System Device Driver Setup
HMS Networks
PCAN Windows CAN device drivers
Subsystems
General OT
Sectors
Multiple
What to Know
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
What to Do
Monitor HMS Networks's web page for any future patch releases.