CVE-2023-48725
Assigner: talos
Published: 2024-03-07T14:59:08.682Z
State: PUBLISHED
affected: vendor: Netgear
product: RAX30
versions: version: 1.0.11.96
status: affected
version: 1.0.7.78
status: affected
descriptions: value: A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7.78. A specially crafted HTTP request can lead to code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
problemTypes: descriptions: description: CWE-121: Stack-based Buffer Overflow
type: CWE
cweId: CWE-121
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
credits: value: Discovered by Michael Gentile of Cisco Talos