CVE-2021-21966: ti cc3100_firmware Use of Uninitialized Variable

Vulnerability summary

CVE-2021-21966 is a medium (CVSS 5.3) Use of Uninitialized Variable vulnerability in ti cc3100_firmware. EPSS estimates a 1.38% chance of exploitation in the next 30 days, higher than 71.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-02-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this vulnerability.

• CWE-457Use of Uninitialized VariableThe code uses a variable that has not been initialized, leading to unpredictable or unintended results.
• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.