Vulnerability Spotlight: Authentication bypass, use-after-free vulnerabilities found in a library for the µC/OS open-source operating system
Summary: Cisco Talos discovered two vulnerabilities in the FTP server of µC/OS, an embedded operating system developed by Micrium that supports TCP/IP, USB, CAN bus and Modbus. TALOS-2022-1680 (CVE-2022-41985) can bypass authentication or cause a denial-of-service via crafted network packets, while TALOS-2022-1681 (CVE-2022-46377 through CVE-2022-46378) can cause a denial-of-service and a use-after-free condition, and Talos confirmed Weston Embedded uC-FTPs version 1.98.00 could be exploited.
Key Takeaway: An authentication bypass in an embedded FTP server means an attacker who can reach the device over the network may not need credentials at all, and Talos confirmed the flaw is exploitable in the current release.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-41985CVE-2022-46377CVE-2022-46378
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026