Cyber Resilience

CVE-2023-46012

CriticalPublic PoC

Published: 07 May 2024

Published
07 May 2024
Modified
30 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3455 97.1th percentile
Risk Priority 40 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-46012 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Linksys Ea7500 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A buffer overflow vulnerability tracked as CVE-2023-46012 affects the Linksys EA7500 router running firmware version 3.0.1.207964. The flaw resides in the IGD UPnP component and is triggered when the device processes a specially crafted HTTP request, corresponding to CWE-120.

Remote attackers can exploit the issue over the network without authentication or user interaction. Successful exploitation grants arbitrary code execution with full impacts on confidentiality, integrity, and availability, reflected in the CVSS 3.1 base score of 9.8.

Public references consist of repositories containing proof-of-concept material for the vulnerability. The current EPSS score of 0.3455, with a peak of 0.3647, indicates moderate and relatively stable exploitation interest since disclosure.

EU & UK References

Vulnerability details

Buffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD UPnP.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Buffer overflow in unauthenticated UPnP IGD service via HTTP SOAP requests enables remote arbitrary code execution as root, facilitating exploitation of public-facing applications and remote services.

Affected Assets

linksys
ea7500 firmware
3.0.1.207964

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-120

Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

References