PT-2015-7102 · Kasda+1 · Kasda Kw58293+1

Eskie Cirrus James Maquilang · Publicado 2015-09-21 · Atualizado 2015-09-21 · CVE-2015-5993

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PLDT SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN Kasda KW58293 devices

Description The issue is related to a buffer overflow in the form2ping.cgi file, which can be exploited by remote attackers to cause a denial of service, resulting in a device outage. This is achieved by sending a long ipaddr parameter.

Recommendations For PLDT SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN, avoid using the ipaddr parameter in the form2ping.cgi file until the issue is resolved. For Kasda KW58293 devices, restrict access to the form2ping.cgi file to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-5993

Produtos afetados

Kasda Kw58293

Pldt Speedsurf 504An

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-5993 · Nota de Segurança
• http://kb.cert.org/vuls/id/525276 · Nota