CVE-2021-21966
Description
An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Texas Instruments/CC3200 SimpleLink Solution NWPdescription
- Range: = 2.9.0.0
Patches
Vulnerability mechanics
Root cause
"Use of an uninitialized variable in the ICMP ping payload buffer when constructing the response to a /ping.html request with the maximum packet size parameter."
Attack vector
An unauthenticated attacker on the same network sends a crafted HTTP POST request to the target device's /ping.html endpoint. The request includes the parameter __SL_P_T.B set to 1472 (the maximum allowed packet size). The NWP's HTTP server processes the request without requiring authentication, as these embedded resources are accessible by default [ref_id=1]. The server constructs an ICMP ping reply whose payload contains uninitialized memory from the NWP's internal buffers, leaking sensitive data such as passwords, tokens, stack cookies, or memory addresses back to the attacker [ref_id=1].
Affected code
The vulnerability resides in the HTTP server's /ping.html action handler within the CC3200 SimpleLink Network Processor (NWP) firmware version 2.9.0.0. The NWP's built-in HTTP server processes POST requests to /ping.html with parameters __SL_P_T.A (target IP), __SL_P_T.B (packet size), and __SL_P_T.C (ping count). The ICMP ping payload buffer is not fully initialized when the packet size parameter is set to the maximum value of 1472 bytes, causing uninitialized stack or heap data to be included in the response.
What the fix does
The advisory does not include a patch or specific remediation code. Texas Instruments was disclosed the vulnerability on 2021-10-21, and the advisory was publicly released on 2022-02-15 [ref_id=1]. No fix has been published in the available materials. The recommended mitigation would be for the vendor to ensure the ICMP ping payload buffer is fully zero-initialized before being populated with user-controlled data, preventing any uninitialized memory from being disclosed in the response.
Preconditions
- configThe target device must be running CC3200 SimpleLink Solution NWP 2.9.0.0 with the default HTTP server enabled
- authNo authentication is required; the /ping.html endpoint is accessible by default
- networkThe attacker must have network access to send HTTP requests to the target device
- inputThe attacker sends a POST request with __SL_P_T.B set to 1472 (maximum packet size)
Reproduction
Send the following curl command to the target device, replacing `
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- talosintelligence.com/vulnerability_reports/TALOS-2021-1393mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.