CVE-2024-5948: fallo de gravedad alta en Deep Sea Electronics DSE855
Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 1.1%
Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of multipart boundaries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23170.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Deep Sea Electronics · DSE855CVEs relacionadas — Deep Sea Electronics DSE855
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-5947MEDIUMDeep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure VulnerabilityEPSS 2.4%CVE-2024-5950HIGHDeep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-5951HIGHDeep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service VulnerabilityEPSS 0.8%CVE-2024-5952MEDIUMDeep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service VulnerabilityEPSS 0.6%CVE-2024-5949MEDIUMDeep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service VulnerabilityEPSS 0.6%