CRITICAL🇵🇱 Wersja polska

CVE-2019-8985

CVSS 9.8v3.0pub. 2019-02-21upd. 2024-11-21

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Netis Systems Wf2411

    HW
    Netis-Systems
    wszystkie wersje

  • Netis Systems Wf2411 Firmware

    OS
    Netis-Systems
    2.1.36123

  • Netis Systems Wf2880

    HW
    Netis-Systems
    wszystkie wersje

  • Netis Systems Wf2880 Firmware

    OS
    Netis-Systems
    2.1.36123
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDoSMemory
CWE
References

Related vulnerabilities

CVE-2021-26747CRITICAL9.8ten sam produkt

Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command,...

CVE-2025-50608HIGH7.5ten sam produkt

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of...

CVE-2025-50609HIGH7.5ten sam produkt

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the...

CVE-2025-50610HIGH7.5ten sam produkt

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of...

CVE-2025-50611HIGH7.5ten sam produkt

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00473154 function of...