Vulnerability Description
An issue was discovered on EDIMAX IC-3140W through 3.06, IC-5150W through 3.09, and IC-6220DC through 3.06 devices. The ipcam_cgi binary contains a stack-based buffer overflow that is possible to trigger from a remote unauthenticated /camera-cgi/public/getsysyeminfo.cgi?action=VALUE_HERE HTTP request: if the VALUE_HERE length is more than 0x400 (1024), it is possible to overwrite other values located on the stack due to an incorrect use of the strcpy() function.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Edimax | Ic-3140W Firmware | <= 3.06 |
| Edimax | Ic-3140W | - |
| Edimax | Ic-5150W Firmware | <= 3.09 |
| Edimax | Ic-5150W | - |
| Edimax | Ic-6220Dc Firmware | <= 3.06 |
| Edimax | Ic-6220Dc | - |
Related Weaknesses (CWE)
References
- https://gitlab.com/nemux/CVE-2018-8072/blob/master/CVE-2018-8072_PoC.txtExploitThird Party Advisory
- https://gitlab.com/nemux/CVE-2018-8072/blob/master/nemux_codemotion_Rome18_coverExploitTechnical DescriptionThird Party Advisory
- https://www.edimax.com/edimax/download/download/data/edimax/uk/download/for_homePatchProductVendor Advisory
- https://www.nemux.org/2018/04/24/cve-2018-8072/PatchThird Party Advisory
- https://gitlab.com/nemux/CVE-2018-8072/blob/master/CVE-2018-8072_PoC.txtExploitThird Party Advisory
- https://gitlab.com/nemux/CVE-2018-8072/blob/master/nemux_codemotion_Rome18_coverExploitTechnical DescriptionThird Party Advisory
- https://www.edimax.com/edimax/download/download/data/edimax/uk/download/for_homePatchProductVendor Advisory
- https://www.nemux.org/2018/04/24/cve-2018-8072/PatchThird Party Advisory
FAQ
What is CVE-2018-8072?
CVE-2018-8072 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered on EDIMAX IC-3140W through 3.06, IC-5150W through 3.09, and IC-6220DC through 3.06 devices. The ipcam_cgi binary contains a stack-based buffer overflow that is possible to trig...
How severe is CVE-2018-8072?
CVE-2018-8072 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-8072?
Check the references section above for vendor advisories and patch information. Affected products include: Edimax Ic-3140W Firmware, Edimax Ic-3140W, Edimax Ic-5150W Firmware, Edimax Ic-5150W, Edimax Ic-6220Dc Firmware.