CVE-2021-36762: Hcc-Embedded Nichestack

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processing function doesn't ensure that a filename is adequately '\0' terminated; therefore, a subsequent call to strlen for the filename might read out of bounds of the protocol packet buffer (if no '\0' byte exists within a reasonable range).

Affected products

• Hcc-Embedded Nichestack: before 4.3 (fixed in 4.3)

Published 2021-08-19. Last modified 2026-06-17.