CVE-2021-32198: 
Homebrew vulnerability analysis and mitigation

EmTec ZOC through version 8.02.4 was affected by a denial of service vulnerability (CVE-2021-32198). The vulnerability allowed remote servers to cause the Windows GUI to hang by triggering rapid window title changes, which resulted in excessive SetWindowTextA or SetWindowTextW calls without implementing proper delays (Pastebin).

The vulnerability stems from the application's handling of window title changes. When a remote server sends commands to change the window title repeatedly at high speed, it causes numerous SetWindowTextA or SetWindowTextW API calls without implementing a usleep or similar delay mechanism. This leads to resource exhaustion and eventually causes the GUI to become unresponsive (Pastebin, Bleeping Computer).

When exploited, the vulnerability results in a denial of service condition where the application freezes. According to testing, this affects only the ZOC application itself rather than the entire system (Bleeping Computer).

The vulnerability can be exploited by a remote server that has the ability to send commands that change the window title. The attack is relatively simple to execute as it only requires the ability to send rapid title change commands to a connected ZOC client (Pastebin).

The vulnerability was fixed in ZOC version 8.02.2, which prevents the ability to paste "\e[201~" sequences and implements proper handling of window title changes (Emtec Changes).