ID
VAR-202112-2105
CVE
CVE-2021-39306
TITLE
Realtek RTL8195AM Out-of-bounds write vulnerabilities in devices
Trust: 0.8
DESCRIPTION
A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big size Authentication challenge text in WEP security. Realtek RTL8195AM The device contains a vulnerability related to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Realtek RTL8195AM is an IoT microcontroller from Taiwan Realtek Semiconductor (Realtek). The Realtek RTL8195AM version before 2.0.10 has a buffer error vulnerability. The vulnerability is caused by the lack of effective processing of large-length text in the software, which leads to a stack buffer overflow. Attackers can send large-size Authentication challenge texts to achieve client-side exploits
Trust: 2.25
AFFECTED PRODUCTS
| vendor: | realtek | model: | rtl8195am | scope: | lt | version: | 2.0.10 | Trust: 1.0 |
| vendor: | realtek semiconductor corp | model: | rtl8195am | scope: | eq | version: | rtl8195am firmware 2.0.10 | Trust: 0.8 |
| vendor: | realtek semiconductor corp | model: | rtl8195am | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
buffer error
Trust: 0.6
PATCH
| title: | Top Page Security Bulletin | url: | https://www.realtek.com/en/ | Trust: 0.8 |
| title: | Realtek RTL8195AM Buffer error vulnerability fix | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=177015 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-39306 | Trust: 3.3 |
| db: | JVNDB | id: | JVNDB-2021-017048 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202112-2203 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2021-39306 | Trust: 0.1 |
REFERENCES
| url: | https://www.realtek.com | Trust: 1.7 |
| url: | https://www.amebaiot.com/en/security_bulletin/cve-2021-39306/ | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-39306 | Trust: 1.4 |
| url: | https://cwe.mitre.org/data/definitions/787.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULMON | id: | CVE-2021-39306 |
| db: | JVNDB | id: | JVNDB-2021-017048 |
| db: | CNNVD | id: | CNNVD-202112-2203 |
| db: | NVD | id: | CVE-2021-39306 |
LAST UPDATE DATE
2024-08-14T14:31:28.327000+00:00
SOURCES UPDATE DATE
| db: | VULMON | id: | CVE-2021-39306 | date: | 2022-01-04T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017048 | date: | 2022-12-28T03:13:00 |
| db: | CNNVD | id: | CNNVD-202112-2203 | date: | 2022-01-05T00:00:00 |
| db: | NVD | id: | CVE-2021-39306 | date: | 2022-01-04T18:49:37.060 |
SOURCES RELEASE DATE
| db: | VULMON | id: | CVE-2021-39306 | date: | 2021-12-22T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017048 | date: | 2022-12-28T00:00:00 |
| db: | CNNVD | id: | CNNVD-202112-2203 | date: | 2021-12-22T00:00:00 |
| db: | NVD | id: | CVE-2021-39306 | date: | 2021-12-22T19:15:11.373 |