CVE-2023-41251
Published: 08 July 2024
Summary
CVE-2023-41251 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Realtek Rtl819X Jungle Software Development Kit. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 11.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11 and is tracked under CWE-121 and CWE-787. The flaw permits remote code execution when a specially crafted series of HTTP requests is processed by the affected component.
An authenticated attacker with high privileges can send malicious HTTP requests over the network to trigger the overflow, resulting in full control over confidentiality, integrity, and availability on the target device according to the CVSS 7.2 rating.
Exploitation probability for this issue has remained low, with a current EPSS score of 0.0414 following a modest peak of 0.0582. Further technical details are provided in the Talos Intelligence vulnerability report TALOS-2023-1894.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-45768
Vulnerability details
A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send an HTTP request to trigger this…
more
vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.