LiveActive security incident?Get immediate response
CVE Record

CVE-2021-27565: The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service...

The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpected valid HTTP request such as OPTIONS. This occurs because the HTTP request handler enters a miscoded wbs_loop() debugger hook.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw can let a remote user knock affected embedded web servers offline by sending a valid but unexpected HTTP request. The business risk is service disruption, especially where NicheStack is embedded in operational technology or networked devices. The source bundle does not provide product mappings, CVSS, or confirmed exploitation.

Executive priority

Treat this as a targeted availability risk, not a confirmed breach indicator. Prioritize asset discovery and management-plane isolation, especially for operational technology or embedded devices supporting critical processes.

Technical view

InterNiche NicheStack through 4.0.1 has an HTTP request-handler bug where certain valid unexpected requests can enter a miscoded wbs_loop() debugger hook, causing an infinite loop and networking outage. Evidence names denial of service only, not code execution or data theft.

Likely exposure

Organizations may be exposed if devices or firmware include InterNiche NicheStack through 4.0.1 with the web server reachable. Exposure is hard to determine because the CVE record lists affected vendor/product fields as n/a.

Exploitation context

The bundle does not show CISA KEV listing or active exploitation. It does describe remote denial of service using an unexpected valid HTTP request such as OPTIONS, so internet- or enterprise-reachable management interfaces increase risk.

Researcher notes

The main evidence gap is product-level applicability. The CVE and CERT reference identify the stack and behavior, but not a complete vendor/device list, patch version, CVSS score, or CWE mapping in the supplied bundle.

Mitigation direction

  • Inventory devices and firmware that include InterNiche NicheStack through 4.0.1.
  • Check HCC Embedded, InterNiche, and device-vendor advisories for supported fixes.
  • Restrict HTTP management access to trusted administrative networks only.
  • Disable embedded web services where they are not operationally required.
  • Monitor affected device classes for unexplained network outages or management-service hangs.

Validation and detection

  • Confirm whether any assets use InterNiche NicheStack through 4.0.1 or earlier.
  • Identify devices exposing embedded HTTP services on untrusted networks.
  • Review vendor firmware release notes for NicheStack or VU#608209 references.
  • Check logs and monitoring for repeated management-service outages.
  • Verify compensating network controls limit access to affected web interfaces.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-27565 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.