9.8

CVE-2023-35802

IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevated privileges to conduct remote code execution. Access to the internal management interface/subnet is required to conduct the exploit.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Extremenetworks ≫ Iq Engine Version < 10.6r1
   Extremenetworks ≫ Ap122 Version-
   Extremenetworks ≫ Ap130 Version-
   Extremenetworks ≫ Ap150w Version-
   Extremenetworks ≫ Ap250 Version-
   Extremenetworks ≫ Ap30 Version-
   Extremenetworks ≫ Ap3000 Version-
   Extremenetworks ≫ Ap3000x Version-
   Extremenetworks ≫ Ap302w Version-
   Extremenetworks ≫ Ap305c Version-
   Extremenetworks ≫ Ap305c-1 Version-
   Extremenetworks ≫ Ap305cx Version-
   Extremenetworks ≫ Ap4000 Version-
   Extremenetworks ≫ Ap4000-1 Version-
   Extremenetworks ≫ Ap410c Version-
   Extremenetworks ≫ Ap410c-1 Version-
   Extremenetworks ≫ Ap460c Version-
   Extremenetworks ≫ Ap460s12c Version-
   Extremenetworks ≫ Ap460s6c Version-
   Extremenetworks ≫ Ap5010 Version-
   Extremenetworks ≫ Ap5050d Version-
   Extremenetworks ≫ Ap5050u Version-
   Extremenetworks ≫ Ap510c Version-
   Extremenetworks ≫ Ap510cx Version-
   Extremenetworks ≫ Ap630 Version-
   Extremenetworks ≫ Ap650 Version-
   Extremenetworks ≫ Ap650x Version-
Extremenetworks ≫ Iq Engine Version < 10.6r5
   Extremenetworks ≫ Ap1130 Version-
   Extremenetworks ≫ Ap550 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.77% 0.855
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.