SecuriTricks - CVE-2024-52015

Description

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at bsw_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

Product(s) Impacted

Product	Versions
Netgear R8500	1.0.2.160
Netgear XR300	1.0.3.78
Netgear R6400 v2	1.0.4.128
Netgear R7000P	1.3.3.154

Weaknesses

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md

https://www.netgear.com/about/security/

CVSS Score

5.7 / 10

CVSS Data

Attack Vector: ADJACENT_NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

View Vector String

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Date

Published: Nov. 5, 2024, 3:15 p.m.
Last Modified: Nov. 5, 2024, 4:35 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2024-52015