1. Home
  2. CVE Database
  3. CVE-2019-8985
CRITICAL · 9.8

CVE-2019-8985

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause den...

Vulnerability Description

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Netis-SystemsWf2411 Firmware2.1.36123
Netis-SystemsWf2411-
Netis-SystemsWf2880 Firmware2.1.36123
Netis-SystemsWf2880-

Related Weaknesses (CWE)

CWE-306CWE-787

References

FAQ

What is CVE-2019-8985?

CVE-2019-8985 is a vulnerability with a CVSS score of 9.8 (CRITICAL). On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause den...

How severe is CVE-2019-8985?

CVE-2019-8985 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-8985?

Check the references section above for vendor advisories and patch information. Affected products include: Netis-Systems Wf2411 Firmware, Netis-Systems Wf2411, Netis-Systems Wf2880 Firmware, Netis-Systems Wf2880.