Cyber Resilience

CVE-2023-41251

High

Published: 08 July 2024

Published
08 July 2024
Modified
04 November 2025
KEV Added
Patch
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0414 88.9th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-41251 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Realtek Rtl819X Jungle Software Development Kit. Its CVSS base score is 7.2 (High).

Operationally, ranked in the top 11.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11 and is tracked under CWE-121 and CWE-787. The flaw permits remote code execution when a specially crafted series of HTTP requests is processed by the affected component.

An authenticated attacker with high privileges can send malicious HTTP requests over the network to trigger the overflow, resulting in full control over confidentiality, integrity, and availability on the target device according to the CVSS 7.2 rating.

Exploitation probability for this issue has remained low, with a current EPSS score of 0.0414 following a modest peak of 0.0582. Further technical details are provided in the Talos Intelligence vulnerability report TALOS-2023-1894.

EU & UK References

Vulnerability details

A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send an HTTP request to trigger this…

more

vulnerability.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

realtek
rtl819x jungle software development kit
3.4.11
level1
wbr-6013 firmware
rer4_a_v3411b_2t2r_lev_09_170623

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References