CVE-2021-25328 — HIGH (8.8)

Vulnerability Description

Skyworth Digital Technology RN510 V.3.1.0.4 RN510 V.3.1.0.4 contains a buffer overflow vulnerability in /cgi-bin/app-staticIP.asp. An authenticated attacker can send a specially crafted request to endpoint which can lead to a denial of service (DoS) or possible code execution on the device.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Skyworthdigital	Rn510 Firmware	3.1.0.4
Skyworthdigital	Rn510	-

Related Weaknesses (CWE)

CWE-120

References

http://packetstormsecurity.com/files/162450/Shenzhen-Skyworth-RN510-Buffer-OverfExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2021/May/5ExploitMailing ListThird Party Advisory
https://s3curityb3ast.github.io/KSA-Dev-011.mdExploitThird Party Advisory
http://packetstormsecurity.com/files/162450/Shenzhen-Skyworth-RN510-Buffer-OverfExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2021/May/5ExploitMailing ListThird Party Advisory
https://s3curityb3ast.github.io/KSA-Dev-011.mdExploitThird Party Advisory

FAQ

What is CVE-2021-25328?

CVE-2021-25328 is a vulnerability with a CVSS score of 8.8 (HIGH). Skyworth Digital Technology RN510 V.3.1.0.4 RN510 V.3.1.0.4 contains a buffer overflow vulnerability in /cgi-bin/app-staticIP.asp. An authenticated attacker can send a specially crafted request to end...

How severe is CVE-2021-25328?

CVE-2021-25328 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-25328?

Check the references section above for vendor advisories and patch information. Affected products include: Skyworthdigital Rn510 Firmware, Skyworthdigital Rn510.