TLP20 tcpTxThread stack overflow

1. Summary

CVE-2021-37164 is a stack-based buffer overflow in the tcpTxThread function of the HMI3 Control Panel firmware that runs on Swisslog Healthcare Translogic Nexus Panels — the control panel that governs a hospital’s Translogic pneumatic tube system (PTS) [1]. When the panel copies received network data into a fixed-size stack buffer, an off-by-three length error writes three bytes past the end of the buffer, corrupting adjacent stack memory [1]. Because the affected code path processes the TLP20 control protocol over the network with no authentication and no user interaction, an attacker with network reachability to the panel can crash it (denial of service) or, with a crafted payload, achieve remote code execution on the device [1][6]. It is one of the nine “PwnedPiper” vulnerabilities disclosed by Armis in 2021, and one of four memory-corruption bugs in the TLP20 protocol implementation [3][5].

2. Affected products & versions

3. The vulnerability in detail

The defect lives in tcpTxThread, a function inside the firmware of the HMI3 Control Panel on the Swisslog Healthcare Translogic Nexus Panel. The Nexus Panel is not an incidental gadget — it is the control panel of a Translogic pneumatic tube system, the network of physical tubes and carriers that hospitals use to shuttle blood samples, lab specimens, medications, and other materials between departments. tcpTxThread is part of the network-handling code that implements the proprietary TLP20 control protocol on the HMI-3 circuit board [1][3]. This places the bug directly on the device’s remote attack surface: a socket-facing thread that parses attacker-influenced bytes before any application-level trust decision has been made.

The root cause is a classic and specific one: improper bounds handling when copying received network data into a fixed-size stack buffer [1]. The firmware reads data off the network and copies it into a buffer allocated on tcpTxThread’s stack frame, but the length calculation governing that copy is wrong by three bytes. The result is an off-by-three condition — the copy writes three bytes beyond the buffer’s high boundary, into whatever stack memory is adjacent [1]. On a typical stack layout, the bytes immediately past a local buffer hold saved registers, the saved frame pointer, and ultimately the saved return address. Overwriting them corrupts the control state the function relies on to return cleanly. This is CWE-787, an out-of-bounds write, and in this instance it manifests as the well-understood stack-based buffer overflow class: the write is out of bounds specifically because it spills off the end of a stack-allocated array [1]. The distinction matters — CWE-787 describes the primitive (a write to memory the code was not entitled to touch), while “stack buffer overflow” describes where and how that primitive is reached, which in turn shapes exploitability. The immediate consequence of the overwrite is confined to the panel process: a three-byte spill is small, so whether it reliably reaches the saved return address (enabling control-flow hijack) versus merely corrupting adjacent locals or the frame pointer (tending toward a crash) depends on the exact stack layout, which the available sources do not detail.

Placing tcpTxThread in context clarifies why the bug is so exposed. This CVE is one of four TLP20-protocol memory-corruption bugs in the PwnedPiper set, sitting alongside a udpRXThread underflow, an sccProcessMsg overflow, and an hmiProcessMsg overflow [5]. All four share the same structural weakness: functions that parse externally-supplied protocol bytes on the HMI-3 board without adequate length validation. tcpTxThread is the TCP-facing member of that family, so the bytes it mishandles arrive over a connected stream rather than a datagram, but the essential failure is identical — trust in an attacker-controlled length field driving a copy into fixed-size stack storage.

The mechanism and trigger are straightforward and require little of the attacker. The preconditions are only two: network reachability to an Ethernet-connected Nexus/HMI3 Control Panel, and vulnerable firmware (a Nexus Software version earlier than 7.2.5.7) [1]. No authentication, no credentials, no physical access, no RF or bus adjacency, and no user interaction are needed — every one of the four TLP20 memory-corruption bugs in this set, including this one, is triggerable by an unauthenticated network packet [6]. The attacker crafts a TLP20-protocol packet and sends it to the panel’s TCP listener. tcpTxThread receives that data and copies it into its stack buffer; the off-by-three miscalculation drives the copy three bytes past the buffer end, overflowing the stack [1]. Depending on the payload, the corrupted stack state either causes the control-panel process to crash — a denial of service that takes the station offline — or, with a deliberately constructed payload, redirects control flow to achieve remote code execution on the panel [1][7]. This is where the bug’s primitive ends; what an attacker can then do to the physical tube system, and how takeover composes with the other PwnedPiper flaws, is downstream consequence and is treated in Section 6, not here.

A step-by-step description of how the bug is reached and what it yields at the device level looks like this:

1. The attacker gains network reachability to an Ethernet-connected Translogic Nexus/HMI3 Control Panel — either because the panel is internet-exposed or because the attacker has a foothold inside the hospital network [5].
2. The attacker sends a crafted, unauthenticated TLP20-protocol packet to the panel’s TCP listener handled by tcpTxThread [1].
3. tcpTxThread copies the received data into a stack buffer; the off-by-three miscalculation writes three bytes past the buffer, overflowing the stack (CWE-787) [1].
4. The stack corruption either crashes the control-panel process (denial of service, loss of station availability) or, with a crafted payload, achieves remote code execution on the panel [1][7].

That is the full extent of what CVE-2021-37164 delivers on its own: an unauthenticated, network-triggered stack overflow in tcpTxThread whose outcome is a crash or code execution on the panel process. It does not, by itself, establish persistence or root — those outcomes depend on chaining to other PwnedPiper bugs, discussed as consequence in Section 6.

4. Discovery & timeline

The vulnerability was discovered and disclosed by Armis, an IoT/OT security research firm, as part of the “PwnedPiper” set of nine vulnerabilities in Swisslog’s Translogic PTS [3][5]. Armis reported the findings to Swisslog on May 1, 2021 [5]. Public disclosure followed in early August 2021, coordinated with a CISA ICS-Medical Advisory (ICSMA-21-215-01) [2]. Public reporting is dated August 2, 2021 [6]; the exact publication date of Armis’s own research hub [3] is not stated in the available sources and is inferred from the surrounding press timing rather than directly sourced. Swisslog responded with fixes delivered in Nexus Software 7.2.5.7; per the vendor, 8 of the 9 PwnedPiper issues — including CVE-2021-37164 — were addressed in 7.2.5.7, with the remaining unauthenticated firmware-upgrade issue slated for a later release [4].

5. Technical reference

• CVE: CVE-2021-37164 [1]
• CWE: CWE-787 (Out-of-bounds Write), manifesting as a stack-based buffer overflow [1]
• CVSS v3.1: 9.8 CRITICAL — vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [1]
• AV:N (network) and AC:L (low complexity): reachable by a single unauthenticated packet with no special conditions.
• PR:N / UI:N: no privileges and no user interaction — the two facts that make this remotely and trivially triggerable.
• S:U (scope unchanged): the CVSS model scores impact on the vulnerable component itself and does not extend to effects beyond it.
• C:H/I:H/A:H: full compromise of confidentiality, integrity, and availability of the panel, consistent with RCE potential.
• CVSS v2: 7.5 [1]
• Code/commit refs: none public; the fix is delivered as a firmware release (Nexus Software 7.2.5.7), not an open-source commit [1][4].
• Advisory bundle: CISA ICSMA-21-215-01 bundles the PwnedPiper CVEs including this one, confirming the unauthenticated network vector and patched version 7.2.5.7 [2].

6. Consequence & CFSE path analysis

Real-world consequence: an unauthenticated attacker who can reach the panel over the network can take over or crash the controller of a hospital pneumatic tube system. In practice that means the specimen/medication transport network can be mis-routed or halted — carriers sent to the wrong destination, or the station taken offline entirely. Per Armis, a compromised Nexus Control Panel lets an attacker act as a man-in-the-middle on carrier transactions, altering requested destinations to mis-route carriers and changing transaction speeds in ways that could damage sensitive payloads such as blood products [6]. What is not in evidence is any demonstrated direct physical injury to a person or high-energy actuation; the harm is to hospital logistics and to the integrity of what the tubes carry.

Chaining beyond this single CVE. Takeover of one control panel via tcpTxThread can be composed with the other PwnedPiper flaws to escalate further. The takeover chain uses hardcoded Telnet credentials plus a privilege-escalation flaw to gain root, and abuse of an unauthenticated/unsigned firmware upgrade to persist in firmware — opening the door to ransomware or data leakage across the affected fleet [6][7]. Two cautions: (a) the persistence, root, and ransomware outcomes map to those other PwnedPiper bugs, not to CVE-2021-37164 alone; and (b) the specific CVE identifiers for those capabilities are CVE-2021-37163 (hardcoded Telnet credentials), CVE-2021-37167 (privilege escalation), and CVE-2021-37160 (unauthenticated firmware update).

Why the CFSE Path Score differs from CVSS: CVSS collapses everything into a single 9.8 driven by the CIA impact on the panel with S:U. CFSE instead decomposes the entry into two co-dominant risk paths and scores each on its own consequence and reach, which is why the picture is richer than one number.

The CFSE path analysis:

• Verdict: CRITICAL.
• Path 1 — DEVICE_CONTROL_SAFETY: treats the unauthenticated, network-reachable RCE via the tcpTxThread stack overflow as full code execution over the pneumatic-tube station controller. It can mis-route or halt hospital specimen/medication transport (PH:2 — no demonstrated direct injury or high-energy actuation) while chaining across network → device → control plane and reportedly to firmware persistence via other PwnedPiper CVEs (CH:4).
• Path 2 — DEVICE_AVAILABILITY: the pure-DoS variant, where a single malformed packet crashes the controller (EC:4), causing loss of station availability with no severe harm.
• Both paths cite a shared fleet-wide parser primitive (SR:4) and remote fleet-scale reach (SX:4). Recovery is via patching to Nexus 7.2.5.7. (The contrast with signing-root rotation is an analytical inference and is not discussed in any cited source — the sources confirm patching to 7.2.5.7 but say nothing about signing-root rotation.)
• Overall path_verdict: CRITICAL, taken as the worst of the two safety/availability paths, with no cap or systemic uplift applied.

The key takeaway: CFSE’s PH:2 deliberately restrains the safety claim (no proven injury) even as the overall band stays CRITICAL on the strength of remote fleet-scale reach and the control-plane/firmware chaining — a nuance the flat 9.8 cannot express.

7. Remediation & mitigations

Grounded, specific actions:

• Primary fix: upgrade Nexus/HMI3 firmware to Nexus Software 7.2.5.7 or later, which contains the fix for this bug (8 of 9 PwnedPiper CVEs, including CVE-2021-37164, are fixed in this release) [1][4].
• Network exposure: ensure Nexus Control Panels are not internet-exposed and are segmented from the general hospital network, since the only non-firmware precondition for this bug is network reachability to the panel’s TLP20 TCP listener [1][5].
• Access control: apply network ACLs restricting which hosts can reach the panels’ TCP listeners — the specific surface tcpTxThread serves [5].
• Detection: deploy the reported Snort IDS signatures to flag the malformed TLP20 traffic patterns associated with the PwnedPiper attacks, which is the traffic that reaches this bug [5].
• Telnet (chain-hardening, not a fix for this bug): block Telnet to the panels. This does not remediate the tcpTxThread overflow itself, but it disrupts the broader takeover/persistence chain, which leverages hardcoded Telnet credentials alongside this bug [5][7]. (The Telnet-credentials issue is a separate PwnedPiper CVE, CVE-2021-37163.)

8. Sources

[1] NVD - CVE-2021-37164 — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2021-37164 — canonical record establishing the off-by-three stack overflow in tcpTxThread, CWE-787, CVSS vectors, and affected/fixed versions. Credibility: primary advisory. [2] ICSMA-21-215-01: Swisslog Healthcare Translogic PTS — CISA (ICS-Medical Advisory) — https://www.cisa.gov/news-events/ics-medical-advisories/icsma-21-215-01 — authoritative government advisory bundling the PwnedPiper CVEs, confirming unauthenticated network vector, patched version, and mitigations. Credibility: primary advisory. [3] PwnedPiper (Armis Research) — Armis — https://www.armis.com/research/pwnedpiper/ — original discoverer’s research hub describing TLP20, the takeover chain, and the four memory-corruption bugs including the tcpTxThread overflow. Credibility: researcher-primary. [4] TransLogic Firmware Vulnerabilities — Swisslog Healthcare — https://www.swisslog-healthcare.com/en-us/company/news/2021/07/translogic-firmware-vulnerabilities — vendor disclosure confirming HMI-3 board firmware flaws, that 8 of 9 issues are fixed in 7.2.5.7, affected Ethernet-connected panels, and remediation. Credibility: primary advisory. [5] PwnedPiper critical bug set impacts major hospitals in North America — BleepingComputer — https://www.bleepingcomputer.com/news/security/pwnedpiper-critical-bug-set-impacts-major-hospitals-in-north-america/ — technical press summary confirming unauthenticated trigger, full panel takeover, scope, and the May 1, 2021 report date. Credibility: reputable press. [6] PwnedPiper vulns have potential to turn Swisslog’s PTS hospital products into Swiss cheese, says Armis — The Register — https://www.theregister.com/2021/08/02/pwnedpiper_swisslog_pts/ — press coverage (dated Aug 2, 2021) detailing RCE/DoS impact, the man-in-the-middle carrier mis-routing / speed-change consequence, and the firmware-persistence/ransomware potential. Credibility: reputable press. [7] PwnedPiper vulnerabilities impact 80% of major hospitals in North America — The Record (Recorded Future News) — https://therecord.media/pwnedpiper-vulnerabilities-impact-80-of-major-hospitals-in-north-america — corroborating scope (3,000+ hospitals / ~80% of major North American hospitals), ransomware/data-leak chaining, and confirmation the bugs were not known to be exploited in the wild. Credibility: reputable press.