Sign-up

ID

VAR-202404-0371


CVE

CVE-2023-49913


TITLE

TP-LINK AC1350 has an unspecified vulnerability (CNVD-2024-20287)

Trust: 0.6

sources: CNVD: CNVD-2024-20287

DESCRIPTION

A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x422448` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115. TP-LINK AC1350 is a router from China's TP-LINK company

Trust: 1.44

sources: NVD: CVE-2023-49913 // CNVD: CNVD-2024-20287

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-20287

AFFECTED PRODUCTS

vendor:tp linkmodel:ac1350 buildscope:eqversion:v5.1.020220926

Trust: 0.6

sources: CNVD: CNVD-2024-20287

CVSS

SEVERITY

CVSSV2

CVSSV3

talos-cna@cisco.com: CVE-2023-49913
value: HIGH

Trust: 1.0

CNVD: CNVD-2024-20287
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-20287
severity: HIGH
baseScore: 8.3
vectorString: AV:N/AC:L/AU:M/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

talos-cna@cisco.com: CVE-2023-49913
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-20287 // NVD: CVE-2023-49913

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

sources: NVD: CVE-2023-49913

PATCH

title:Patch for TP-LINK AC1350 has an unspecified vulnerability (CNVD-2024-20287)url:https://www.cnvd.org.cn/patchInfo/show/544066

Trust: 0.6

sources: CNVD: CNVD-2024-20287

EXTERNAL IDS

db:NVDid:CVE-2023-49913

Trust: 1.6

db:TALOSid:TALOS-2023-1888

Trust: 1.0

db:CNVDid:CNVD-2024-20287

Trust: 0.6

sources: CNVD: CNVD-2024-20287 // NVD: CVE-2023-49913

REFERENCES

url:https://talosintelligence.com/vulnerability_reports/talos-2023-1888

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2023-49913

Trust: 0.6

sources: CNVD: CNVD-2024-20287 // NVD: CVE-2023-49913

SOURCES

db:CNVDid:CNVD-2024-20287
db:NVDid:CVE-2023-49913

LAST UPDATE DATE

2024-10-18T03:41:22.578000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-20287date:2024-04-25T00:00:00
db:NVDid:CVE-2023-49913date:2024-04-10T13:24:22.187

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-20287date:2024-04-18T00:00:00
db:NVDid:CVE-2023-49913date:2024-04-09T15:15:30.783