CVE-2021-21905

PoC —

CVSS 3.1

7.2 high

EPSS

<1%p59

Published

Dec 22, 2021 (Dec 22, 2021)

Modified

Jun 17, 2026

Description

Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locations. The Garrett iC Module exposes an authenticated CLI over TCP port 6877. This interface is used by a secondary GUI client, called “CMA Connect”, to interact with the iC Module on behalf of the user. After a client successfully authenticates, they can send plaintext commands to manipulate the device.

Vendors: garrett
Products: ic module cma
Weakness: CWE-121, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news2 stories

Vulnerability Spotlight: Vulnerabilities in metal detector peripheral could allow attackers to manipulate security devices

Cisco TalosDec 20, 16:11 UTC · Dec 20, 2021Vulnerability in the wildCVE-2021-21901 CVE-2021-21903 CVE-2021-21905+6 CVEs

Garrett Walk-Through Metal Detectors Can Be Hacked Remotely

The Hacker NewsDec 28, 09:32 UTC · Dec 28, 2021Vulnerability CVE-2021-21901 CVE-2021-21903 CVE-2021-21905+6 CVEs