Sign-up

ID

VAR-202405-1812


CVE

CVE-2023-49909


TITLE

TP-LINK AC1350 has an unspecified vulnerability (CNVD-2024-23784)

Trust: 0.6

sources: CNVD: CNVD-2024-23784

DESCRIPTION

A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x0045ab38` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225. TP-LINK AC1350 is a router from China's TP-LINK company

Trust: 1.44

sources: NVD: CVE-2023-49909 // CNVD: CNVD-2024-23784

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-23784

AFFECTED PRODUCTS

vendor:tp linkmodel:ac1350 buildscope:eqversion:v5.1.020220926

Trust: 0.6

sources: CNVD: CNVD-2024-23784

CVSS

SEVERITY

CVSSV2

CVSSV3

talos-cna@cisco.com: CVE-2023-49909
value: HIGH

Trust: 1.0

CNVD: CNVD-2024-23784
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-23784
severity: HIGH
baseScore: 8.3
vectorString: AV:N/AC:L/AU:M/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

talos-cna@cisco.com: CVE-2023-49909
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-23784 // NVD: CVE-2023-49909

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

sources: NVD: CVE-2023-49909

PATCH

title:Patch for TP-LINK AC1350 has an unspecified vulnerability (CNVD-2024-23784)url:https://www.cnvd.org.cn/patchInfo/show/546461

Trust: 0.6

sources: CNVD: CNVD-2024-23784

EXTERNAL IDS

db:NVDid:CVE-2023-49909

Trust: 1.6

db:TALOSid:TALOS-2023-1888

Trust: 1.0

db:CNVDid:CNVD-2024-23784

Trust: 0.6

sources: CNVD: CNVD-2024-23784 // NVD: CVE-2023-49909

REFERENCES

url:https://talosintelligence.com/vulnerability_reports/talos-2023-1888

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2023-49909

Trust: 0.6

sources: CNVD: CNVD-2024-23784 // NVD: CVE-2023-49909

SOURCES

db:CNVDid:CNVD-2024-23784
db:NVDid:CVE-2023-49909

LAST UPDATE DATE

2024-10-18T03:41:22.609000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-23784date:2024-05-23T00:00:00
db:NVDid:CVE-2023-49909date:2024-04-10T13:24:22.187

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-23784date:2024-05-15T00:00:00
db:NVDid:CVE-2023-49909date:2024-04-09T15:15:30.013