{"id":"CVE-2021-42698","state":"PUBLISHED","title":"AzeoTech DAQFactory","description":"Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory.","publishedAt":"2021-11-05T15:39:34.000Z","updatedAt":"2024-08-04T03:38:50.112Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["AzeoTech DAQFactory"],"affected":[{"vendor":"AzeoTech","product":"DAQFactory","versions":[{"version":"All versions","status":"affected","lessThanOrEqual":"New version","versionType":"custom"}]}],"references":["https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T19:49:04.473Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/42xxx/CVE-2021-42698.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-42698","state":"PUBLISHED","datePublished":"2021-11-05T15:39:34.000Z","dateUpdated":"2024-08-04T03:38:50.112Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2021-10-18T00:00:00.000Z"},"containers":{"cna":{"title":"AzeoTech DAQFactory","descriptions":[{"lang":"en","value":"Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory."}],"affected":[{"vendor":"AzeoTech","product":"DAQFactory","versions":[{"version":"All versions","status":"affected","lessThanOrEqual":"New version","versionType":"custom"}]}],"references":[{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","dateUpdated":"2021-11-05T15:39:34.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6"},"source":{"discovery":"UNKNOWN"},"workarounds":[{"lang":"en","value":"Users are discouraged from using documents from unknown/untrusted sources.\nUsers are encouraged to store .ctl files in a folder only writeable by admin-level users.\nUsers are encouraged to operate in “Safe Mode” when loading documents that have been out of their control.\nUsers are encouraged to apply a document editing password to their documents.\nUsers should avoid using the Real Time Web-Connect menu items and instead connect to DAQConnect using script."}],"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2021-42698","STATE":"PUBLIC","TITLE":"AzeoTech DAQFactory"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"DAQFactory","version":{"version_data":[{"version_affected":"<=","version_name":"All versions","version_value":"New version"}]}}]},"vendor_name":"AzeoTech"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-502 Deserialization of Untrusted Data"}]}]},"references":{"reference_data":[{"name":"https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02","refsource":"MISC","url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02"}]},"source":{"discovery":"UNKNOWN"},"work_around":[{"lang":"en","value":"Users are discouraged from using documents from unknown/untrusted sources.\nUsers are encouraged to store .ctl files in a folder only writeable by admin-level users.\nUsers are encouraged to operate in “Safe Mode” when loading documents that have been out of their control.\nUsers are encouraged to apply a document editing password to their documents.\nUsers should avoid using the Real Time Web-Connect menu items and instead connect to DAQConnect using script."}]}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T03:38:50.112Z"}}]}}}