CVE-2023-50330
Published: 08 July 2024
Summary
CVE-2023-50330 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Realtek Rtl819X Jungle Software Development Kit. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A stack-based buffer overflow vulnerability, tracked as CVE-2023-50330 and assigned CWE-121 and CWE-787, affects the boa getInfo functionality in Realtek rtl819x Jungle SDK version 3.4.11. The flaw carries a CVSS 3.1 score of 7.2 and can be triggered by a specially crafted series of HTTP requests, potentially resulting in remote code execution.
An authenticated attacker with high privileges can send the malicious HTTP requests over the network to exploit the issue, achieving full control over the affected device with impacts to confidentiality, integrity, and availability. The EPSS score has remained flat at 0.1010 with no material rise observed after disclosure. Public advisories from Talos Intelligence detail the vulnerability under TALOS-2023-1903.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55135
Vulnerability details
A stack-based buffer overflow vulnerability exists in the boa getInfo functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to…
more
trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.