Sign-up

ID

VAR-202202-0900


CVE

CVE-2022-24973


TITLE

TP-LINK Technologies  of  TL-WR940N  Stack-based buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2022-021738

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13992. TP-LINK Technologies of TL-WR940N A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.34

sources: NVD: CVE-2022-24973 // JVNDB: JVNDB-2022-021738 // ZDI: ZDI-22-406 // VULMON: CVE-2022-24973

AFFECTED PRODUCTS

vendor:tp linkmodel:tl-wr940nscope: - version: -

Trust: 1.5

vendor:tp linkmodel:tl-wr940nscope:eqversion:3.20.1

Trust: 1.0

vendor:tp linkmodel:tl-wr940nscope:eqversion:tl-wr940n firmware 3.20.1

Trust: 0.8

vendor:tp linkmodel:tl-wr940nscope:eqversion: -

Trust: 0.8

sources: ZDI: ZDI-22-406 // JVNDB: JVNDB-2022-021738 // NVD: CVE-2022-24973

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-24973
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2022-24973
value: HIGH

Trust: 1.0

NVD: CVE-2022-24973
value: HIGH

Trust: 0.8

ZDI: CVE-2022-24973
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-202202-1734
value: HIGH

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-24973
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2022-24973
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-24973
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-24973
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-406 // JVNDB: JVNDB-2022-021738 // CNNVD: CNNVD-202202-1734 // NVD: CVE-2022-24973 // NVD: CVE-2022-24973

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:Stack-based buffer overflow (CWE-121) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-021738 // NVD: CVE-2022-24973

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202202-1734

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202202-1734

EXTERNAL IDS

db:NVDid:CVE-2022-24973

Trust: 4.0

db:ZDIid:ZDI-22-406

Trust: 3.2

db:JVNDBid:JVNDB-2022-021738

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-13992

Trust: 0.7

db:CNNVDid:CNNVD-202202-1734

Trust: 0.6

db:VULMONid:CVE-2022-24973

Trust: 0.1

sources: ZDI: ZDI-22-406 // VULMON: CVE-2022-24973 // JVNDB: JVNDB-2022-021738 // CNNVD: CNNVD-202202-1734 // NVD: CVE-2022-24973

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-406/

Trust: 3.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-24973

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-24973/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/121.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2022-24973 // JVNDB: JVNDB-2022-021738 // CNNVD: CNNVD-202202-1734 // NVD: CVE-2022-24973

CREDITS

Vadym Kolisnichenko

Trust: 1.3

sources: ZDI: ZDI-22-406 // CNNVD: CNNVD-202202-1734

SOURCES

db:ZDIid:ZDI-22-406
db:VULMONid:CVE-2022-24973
db:JVNDBid:JVNDB-2022-021738
db:CNNVDid:CNNVD-202202-1734
db:NVDid:CVE-2022-24973

LAST UPDATE DATE

2024-08-14T14:55:37.197000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-406date:2022-02-22T00:00:00
db:VULMONid:CVE-2022-24973date:2023-03-28T00:00:00
db:JVNDBid:JVNDB-2022-021738date:2023-11-14T02:52:00
db:CNNVDid:CNNVD-202202-1734date:2023-04-06T00:00:00
db:NVDid:CVE-2022-24973date:2023-04-05T03:35:31.440

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-406date:2022-02-22T00:00:00
db:VULMONid:CVE-2022-24973date:2023-03-28T00:00:00
db:JVNDBid:JVNDB-2022-021738date:2023-11-14T00:00:00
db:CNNVDid:CNNVD-202202-1734date:2022-02-22T00:00:00
db:NVDid:CVE-2022-24973date:2023-03-28T19:15:11.203