SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-3921

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, authenticated attacker to /GponForm/usb_Form?script/.

HIGH 8.8EPSS 17.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 17.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, authenticated attacker to /GponForm/usb_Form?script/. An attacker can leverage this vulnerability to potentially execute arbitrary code.

CVSS 3.1
8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
17.89% probability · 97th percentile
CISA KEV
Not listed
Weakness
CWE-121, CWE-787
Affected
nokia/i-240w-q gpon ont firmware
Source
vulnreport@tenable.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.