Security readout for executives and security teams
Plain-English summary
CVE-2021-46671 is a remote information disclosure issue in atftp before 0.7.5. A remote client could trigger an out-of-bounds read that exposes server-side /etc/group data. This is sensitive system metadata, but the provided sources do not show code execution or active exploitation.
Executive priority
Prioritize remediation for internet-facing or broadly reachable atftp deployments. The business risk is disclosure of local group information, which may assist follow-on attacks, but the provided evidence does not indicate active exploitation or system takeover.
Technical view
The issue is in options.c in atftp before 0.7.5. It reads past the end of an array and can disclose server-side /etc/group contents to a remote client. CVSS and CWE data are not provided in the source bundle, and CISA KEV is false.
Likely exposure
Exposure is most likely on systems running atftp versions earlier than 0.7.5 where remote clients can interact with the service. Debian issued a security update in May 2022, so unmanaged or legacy installations are the main concern.
Exploitation context
The source bundle supports remote information disclosure but does not cite public exploitation, weaponized tooling, or KEV inclusion. Treat it as remotely reachable data leakage until affected atftp instances are confirmed updated or removed.
Researcher notes
Key gaps are absent CVSS, absent CWE mapping, and limited affected-product metadata in the supplied CVE record. Analysis should stay scoped to atftp before 0.7.5 and the Debian security update unless additional vendor advisories are reviewed.
Mitigation direction
- Inventory systems running atftp and record installed versions.
- Upgrade atftp to 0.7.5 or a vendor-supported fixed package.
- Apply the Debian atftp security update where applicable.
- Restrict remote client access to atftp services where still required.
- Remove atftp from systems that do not need it.
Validation and detection
- Confirm installed atftp versions are not earlier than 0.7.5.
- Check package manager history for the Debian security update where applicable.
- Verify exposed services still require atftp operationally.
- Review logs for unusual remote client interaction if telemetry is available.
- Document any accepted risk for legacy systems that cannot be updated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-46671 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://sourceforge.net/p/atftp/code/ci/9cf799c40738722001552618518279e9f0ef62e5CVE reference · x_refsource_MISC
- https://bugs.debian.org/1004974CVE reference · x_refsource_MISC
- [debian-lts-announce] 20220527 [SECURITY] [DLA 3028-1] atftp security updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.