CVE-2023-50243
Published: 08 July 2024
Summary
CVE-2023-50243 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Realtek Rtl819X Jungle Software Development Kit. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-50243 consists of two stack-based buffer overflow vulnerabilities in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK version 3.4.11. The flaws are tied to handling of the comment request parameter and are tracked under CWE-121 and CWE-787. Successful exploitation can result in remote code execution when triggered by crafted input.
An attacker with administrative HTTP access can send a specially crafted series of requests to the affected device to overflow the stack and achieve arbitrary code execution. The CVSS 7.2 score reflects network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, but requires high privileges.
The referenced Talos Intelligence report at https://talosintelligence.com/vulnerability_reports/TALOS-2023-1895 provides the technical analysis of the issues. The EPSS score has remained flat at 0.1010 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55062
Vulnerability details
Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to…
more
trigger these vulnerabilities.This stack-based buffer overflow is related to the `comment` request's parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.