CVE-2023-48724 - Vulnerability Details - OpenCVE

A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an unauthenticated HTTP POST request to trigger this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864

History

No history.

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-04-09T14:12:47.393Z

Updated: 2024-08-02T21:37:54.685Z

Reserved: 2023-11-22T15:41:33.640Z

Link: CVE-2023-48724

Vulnrichment

Updated: 2024-08-02T21:37:54.685Z

NVD

Status : Awaiting Analysis

Published: 2024-04-09T15:15:28.397

Modified: 2024-11-21T08:32:19.990

Link: CVE-2023-48724

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-48724", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2023-11-22T15:41:33.640Z", "datePublished": "2024-04-09T14:12:47.393Z", "dateUpdated": "2024-08-02T21:37:54.685Z"}, "containers": {"cna": {"affected": [{"vendor": "Tp-Link", "product": "AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)", "versions": [{"version": "v5.1.0 Build 20220926", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an unauthenticated HTTP POST request to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE", "cweId": "CWE-121"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-04-09T17:00:09.474Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864"}], "credits": [{"lang": "en", "value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-48724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-09T17:06:09.308925Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:tp-link:ac1350_firmware:*:*:*:*:*:*:*:*"], "vendor": "tp-link", "product": "ac1350_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "v5.1.0 Build 20220926"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:27:32.120Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:37:54.685Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:37:54.685Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-48724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-09T17:06:09.308925Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:tp-link:ac1350_firmware:*:*:*:*:*:*:*:*"], "vendor": "tp-link", "product": "ac1350_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "v5.1.0 Build 20220926"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T17:28:50.995Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"credits": [{"lang": "en", "value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Tp-Link", "product": "AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)", "versions": [{"status": "affected", "version": "v5.1.0 Build 20220926"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864"}], "descriptions": [{"lang": "en", "value": "A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an unauthenticated HTTP POST request to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-04-09T17:00:09.474Z"}}}, "cveMetadata": {"cveId": "CVE-2023-48724", "state": "PUBLISHED", "dateUpdated": "2024-08-02T21:37:54.685Z", "dateReserved": "2023-11-22T15:41:33.640Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2024-04-09T14:12:47.393Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}