CVE-2023-39550

Exploit

EPSS 0.35%
Published 07.08.2023 19:15:11
Last modified 21.11.2024 08:15:39
Source cve@mitre.org
Teams watchlist Login
Open Login

Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the check_auth function.

Affected products Warnungen 0 Metrics 2 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Netgear ≫ Jwnr2000v2 Firmware Version1.0.0.11

Netgear ≫ Jwnr2000v2 Version-

Netgear ≫ Xwn5001 Firmware Version0.4.1.1

Netgear ≫ Xwn5001 Version-

Netgear ≫ Xavn2001v2 Firmware Version0.4.0.7

Netgear ≫ Xavn2001v2 Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.35%	0.563

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

https://www.netgear.com/about/security/

Vendor Advisory

https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_auth/README.md

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2023-39550

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-39550

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-39550

EUVD