ID
VAR-202403-1395
CVE
CVE-2024-25139
TITLE
TP-LINK Omada ER605 Buffer Overflow Vulnerability
Trust: 0.6
DESCRIPTION
In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119. TP-LINK Omada ER605 is a VPN router from TP-LINK of China. TP-LINK Omada ER605 versions 1.0.1 to 2.2.3 have a buffer overflow vulnerability, which is caused by a boundary error when the application processes untrusted input. A remote attacker can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack
Trust: 1.44
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tp link | model: | omada er605 | scope: | gte | version: | 1.0.1,<=2.2.3 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-120 | Trust: 1.0 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-25139 | Trust: 1.6 |
| db: | CNVD | id: | CNVD-2025-03274 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/microsoft/microsoft-tp-link-research-team | Trust: 1.0 |
| url: | https://www.tp-link.com/us/omada-sdn/ | Trust: 1.0 |
| url: | https://cxsecurity.com/cveshow/cve-2024-25139/ | Trust: 0.6 |
SOURCES
| db: | CNVD | id: | CNVD-2025-03274 |
| db: | NVD | id: | CVE-2024-25139 |
LAST UPDATE DATE
2025-02-22T23:21:28.630000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-03274 | date: | 2025-02-20T00:00:00 |
| db: | NVD | id: | CVE-2024-25139 | date: | 2024-08-05T14:35:05.477 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-03274 | date: | 2025-02-20T00:00:00 |
| db: | NVD | id: | CVE-2024-25139 | date: | 2024-03-14T16:15:50.077 |