OpenSSL EVP_CipherUpdate overflow (CVE-2021-23840)

Summary

An integer overflow in OpenSSL encryption functions can trigger denial of service.

Vulnerability ID	Vulnerability Overview
CVE-2021-23840	Passing exceptionally large data to EVP_CipherUpdate causes an integer overflow and a subsequent out-of-bounds write or application crash.

Affected Supported TeraStations

TS5010/3020/3010
Fixed in firmware version 6.12
 

Back to Security Notices

Date	Description
09/10/2026	Initial release

Back to Security Notices