ID
VAR-202403-1395
CVE
CVE-2024-25139
TITLE
TP-LINK Technologies of ER605 Classic buffer overflow vulnerability in firmware
Trust: 0.8
DESCRIPTION
In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119. TP-LINK Technologies of ER605 Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TP-LINK Omada ER605 is a VPN router from TP-LINK of China. TP-LINK Omada ER605 versions 1.0.1 to 2.2.3 have a buffer overflow vulnerability, which is caused by a boundary error when the application processes untrusted input. A remote attacker can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tp link | model: | omada er605 | scope: | lte | version: | 2.2.3 | Trust: 1.0 |
| vendor: | tp link | model: | omada er605 | scope: | gte | version: | 1.0 | Trust: 1.0 |
| vendor: | tp link | model: | er605 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | tp link | model: | er605 | scope: | eq | version: | er605 firmware 1.0 to 2.2.3 | Trust: 0.8 |
| vendor: | tp link | model: | er605 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tp link | model: | omada er605 | scope: | gte | version: | 1.0.1,<=2.2.3 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-120 | Trust: 1.0 |
| problemtype: | Classic buffer overflow (CWE-120) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-25139 | Trust: 3.2 |
| db: | JVNDB | id: | JVNDB-2024-028074 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-03274 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/microsoft/microsoft-tp-link-research-team | Trust: 1.8 |
| url: | https://www.tp-link.com/us/omada-sdn/ | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-25139 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2024-25139/ | Trust: 0.6 |
SOURCES
| db: | CNVD | id: | CNVD-2025-03274 |
| db: | JVNDB | id: | JVNDB-2024-028074 |
| db: | NVD | id: | CVE-2024-25139 |
LAST UPDATE DATE
2025-09-28T03:22:28.019000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-03274 | date: | 2025-02-20T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-028074 | date: | 2025-09-26T01:02:00 |
| db: | NVD | id: | CVE-2024-25139 | date: | 2025-09-18T16:30:09.377 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-03274 | date: | 2025-02-20T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-028074 | date: | 2025-09-26T00:00:00 |
| db: | NVD | id: | CVE-2024-25139 | date: | 2024-03-14T16:15:50.077 |