CVE-2024-40086
Published: 21 October 2024
Summary
CVE-2024-40086 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Vilo (inferred from references). Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A Buffer Overflow vulnerability exists in the local_app_set_router_wifi_SSID_PWD function of the Vilo 5 Mesh WiFi System in versions up to and including 5.16.1.33. The flaw, tracked as CWE-120, is triggered when the function processes a password field longer than 64 bytes and carries a CVSS 3.1 score of 9.6.
Remote unauthenticated attackers positioned on the adjacent network can exploit the issue without user interaction to execute arbitrary code, resulting in complete compromise of confidentiality, integrity, and availability on affected devices.
The current EPSS score of 0.0726 matches its recorded peak with no material rise since disclosure. Public references include the vendor domain and a detailed technical write-up hosted on GitHub.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38408
Vulnerability details
A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via a password field larger than 64 bytes in length.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.