CVE-2019-8985
Critical
Description
On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNetis-systems Wf2411 Firmware
PublishedFeb 21, 2019
First seenFeb 21, 2019
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netis-systems wf2411_firmware | 2.1.36123 | — |
| netis-systems wf2880_firmware | 2.1.36123 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.