CVE-2023-24796
Published: 26 April 2023
Summary
CVE-2023-24796 is a critical-severity an unspecified weakness vulnerability in Vinga Wr-Ac1200 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-24796 is a password-related vulnerability affecting the Vinga WR-AC1200 wireless router in firmware versions 81.102.1.4370 and earlier. The flaw resides in the handling of the password parameter at the /goform/sysTools and /adm/systools.asp endpoints and carries a CVSS 3.1 base score of 9.8.
A remote attacker with no credentials or user interaction can supply a crafted password value to these endpoints and achieve arbitrary code execution on the device, resulting in full compromise of confidentiality, integrity, and availability.
The two provided references point to the same public gist containing technical details of the issue; no vendor advisory, firmware update, or mitigation guidance is referenced in the available data. The associated EPSS score has remained low, with a current value of 0.0491 and a peak of 0.0566.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28795
Vulnerability details
Password vulnerability found in Vinga WR-AC1200 81.102.1.4370 and before allows a remote attacker to execute arbitrary code via the password parameter at the /goform/sysTools and /adm/systools.asp endpoints.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.