Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-50694 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Sungrowpower Winet-S Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-50694 is a stack-based buffer overflow vulnerability (CWE-121) affecting SunGrow WiNet-SV200 software in versions 001.00.P027 and earlier. The issue arises when the software copies a timestamp extracted from an MQTT message into a fixed-size buffer without performing bounds checks, potentially allowing arbitrary data to overflow the stack.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By sending a specially crafted MQTT message containing an oversized timestamp, an attacker could overwrite stack memory, potentially leading to remote code execution, denial of service, or unauthorized access to confidential data and system integrity.
SunGrow has published a security notice detailing the vulnerability at https://en.sungrowpower.com/security-notice-detail-2/5961, which serves as the primary reference for affected users seeking mitigation guidance or patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44593
Vulnerability Data
In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer…
more
overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and analysis can discover stack-buffer overflows before deployment.
Input validation directly stops untrusted data from exceeding stack buffer bounds.
Memory-protection mechanisms limit the ability to execute injected code after a stack overflow.
Secure-engineering principles include bounds-checked coding and safe buffer handling that avoid introducing the flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly prevent introduction of stack buffer overflows.
Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.
Patching eliminates known instances of the weakness after discovery.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing (fuzzing, static analysis) detects stack overflows before release.
Secure SDLC mandates buffer-safety practices that directly prevent stack overflows.
Application security requirements can specify buffer-size and input-validation rules.
Secure architecture principles include memory-safety and least-privilege stack usage.
Secure coding standards explicitly forbid unsafe buffer handling that causes CWE-121.
Change-management gates can enforce security reviews that catch buffer issues.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248594 OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. prevents CWE-121
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-121