CVE-2023-50244
Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `entry_name` request's parameter.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-121, CWE-787
- Affected
- realtek/rtl819x jungle software development kit · level1/wbr-6013 firmware
- Source
- talos-cna@cisco.com
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1895Exploit, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1895Exploit, Third Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1895
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.