Security readout for executives and security teams
Plain-English summary
CVE-2021-47881 affects Data Device Corporation dataSIMS Avionics ARINC 664-1 version 4.5.3. A malicious local file can trigger a buffer overflow and may allow code execution on a Windows system. Business urgency is high where this software is installed on engineering, avionics test, or operational support workstations.
Executive priority
Prioritize review in environments supporting avionics or databus testing. The vulnerability is local, but impact is high if an attacker can influence files processed by the software. Remediation depends on vendor guidance, which is not named in the provided sources.
Technical view
The issue is a local stack-based buffer overflow, classified as CWE-121. The vulnerable application processes milstd1553result.txt unsafely, allowing memory overwrite and potential arbitrary code execution. The CVSS 3.1 score is 8.4 with local attack vector, low complexity, no privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to systems running dataSIMS Avionics ARINC 664-1 version 4.5.3. Risk is most relevant on Windows workstations that open or process dataSIMS result files, especially in avionics, databus testing, or engineering environments.
Exploitation context
A public ExploitDB reference exists, indicating public technical exploit information is available. The source bundle does not indicate CISA KEV listing or confirmed active exploitation. Treat this as credible but locally triggered risk requiring access to place or influence the processed file.
Researcher notes
Evidence supports a local buffer overflow in version 4.5.3 with potential arbitrary code execution. Public exploit material is referenced, but active exploitation is not established. No affected versions beyond 4.5.3 or specific vendor patch details are provided in the source bundle.
Mitigation direction
- Identify whether dataSIMS Avionics ARINC 664-1 version 4.5.3 is installed.
- Check Data Device Corporation guidance for fixed versions or vendor mitigations.
- Restrict write access to directories containing processed result files.
- Avoid processing untrusted milstd1553result.txt files.
- Run affected software on isolated, non-production engineering workstations where possible.
- Monitor vendor and VulnCheck advisories for update information.
Validation and detection
- Inventory installed dataSIMS Avionics ARINC versions across engineering and test systems.
- Confirm whether version 4.5.3 is present.
- Review file permissions around dataSIMS working directories and result files.
- Check endpoint logs for unexpected crashes of the affected application.
- Verify whether compensating controls prevent untrusted file placement or processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47881 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49577CVE reference · exploit
- Vendor HomepageCVE reference · product
- Software Product PageCVE reference · product
- VulnCheck Advisory: dataSIMS Avionics ARINC 664-1 - Local Buffer OverflowCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.