SecuriTricks - CVE-2024-48457

Description

An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the endpoint /cgi-bin/skk_set.cgi and binary /bin/scripts/start_wifi.sh

Product(s) Impacted

Product	Versions
Netis Wifi6 Router NX10	['2.0.1.3643', '2.0.1.3582']
Netis Wifi 11AC Router NC65	['3.0.0.3749']
Netis Wifi 11AC Router NC63	['3.0.0.3327', '3.0.0.3503']
Netis Wifi 11AC Router NC21	['3.0.0.3800', '3.0.0.3500', '3.0.0.3329']
Netis Wifi Router MW5360	['1.0.1.3442', '1.0.1.3031']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References

https://github.com/users/h00die-gr3y/projects/1/views/1

CVSS Score

7.5 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

View Vector String

Timeline

Published: Jan. 6, 2025, 10:15 p.m.
Last Modified: Jan. 7, 2025, 4:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2024-48457