Security readout for executives and security teams
Plain-English summary
This vulnerability affects Sealevel SeaConnect 370W devices running v1.3.34. If an attacker can intercept and manipulate MQTT traffic used by OTA updates, a crafted message can disrupt the device. The main business impact is service interruption in environments relying on these devices for monitoring or control.
Executive priority
Treat this as a moderate operational risk. It is not supported as actively exploited in the provided sources, but affected devices in production monitoring or control environments should be reviewed promptly because successful exploitation can cause denial of service.
Technical view
CVE-2021-21967 is a CWE-120 out-of-bounds write in SeaConnect 370W v1.3.34 OTA update task handling. The CVSS 3.0 score is 6.5, with network attack vector, high complexity, no privileges or user interaction, low integrity impact, and high availability impact. Sources describe a crafted MQTT payload requiring a man-in-the-middle position.
Likely exposure
Exposure appears limited to organizations using Sealevel SeaConnect 370W v1.3.34, especially where MQTT or OTA update traffic traverses networks an attacker could intercept. The source bundle does not identify other affected versions or products.
Exploitation context
The CVE is not listed as CISA KEV in the provided bundle, and no active exploitation evidence is cited. Exploitation requires a man-in-the-middle condition and a crafted MQTT payload, raising complexity but leaving exposed operational networks at risk of denial of service.
Researcher notes
Evidence is narrow and product-specific. The bundle identifies SeaConnect 370W v1.3.34, OTA update task handling, MQTT payload delivery, and man-in-the-middle precondition. No patch version, exploit-in-the-wild status, or broader affected-version range is provided, so avoid extrapolating beyond the cited sources.
Mitigation direction
- Inventory SeaConnect 370W devices and confirm firmware versions.
- Check Sealevel and Talos guidance for vendor-approved updates or mitigations.
- Restrict MQTT and OTA update traffic to trusted network paths.
- Use network segmentation to limit attacker access to device communications.
- Monitor affected environments for device resets, disconnects, or update failures.
Validation and detection
- Confirm whether SeaConnect 370W v1.3.34 is deployed.
- Map MQTT and OTA update paths for those devices.
- Assess whether attackers could intercept device MQTT traffic.
- Review logs for unexplained availability issues around update activity.
- Track vendor advisory status before approving remediation closure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-21967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H2.24.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.5MediumVector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1394CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.