SecuriTricks - CVE-2024-52026

Description

Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at bsw_pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

Product(s) Impacted

Product	Versions
Netgear XR300	1.0.3.78
Netgear R7000P	1.3.3.154
Netgear R6400	1.0.4.128

Weaknesses

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md

https://www.netgear.com/about/security/

CVSS Score

5.7 / 10

CVSS Data

Attack Vector: ADJACENT_NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

View Vector String

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Date

Published: Nov. 5, 2024, 3:15 p.m.
Last Modified: Nov. 5, 2024, 4:35 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2024-52026