Executive brief
Compuphase Termite is a terminal program used for communicating with hardware devices via serial (RS232) ports. A security flaw in the application's settings menu allows a local user to crash the software by entering an excessively long text string into the language configuration field. This results in a denial of service, preventing the user from using the tool to manage or monitor connected hardware.
Technical details
A stack-based buffer overflow (CWE-787) exists in Compuphase Termite version 3.4 within the 'User interface language' settings field. The vulnerability is triggered when a local attacker inputs or pastes a large payload (approximately 2000 bytes) into this specific configuration field. Because the application fails to perform adequate bounds checking on this input, the memory overflow causes the application to crash. This is a local attack requiring access to the application's user interface, and while it primarily results in a denial of service, typical buffer overflows of this nature can sometimes be leveraged for broader memory corruption. No official patch has been noted in the advisory, though the software is free for use.
Affected products
- Compuphase Termite 3.4
Timeline
- 2018-09-23: disclosed: Vulnerability discovered by Abdullah Alıç
- 2018-09-24: other: Vendor notified and exploit published on Exploit-DB
- 2026-04-04: advisory: CVE-2018-25253 published via VulnCheck/NVD