PT-2017-7843 · Jensen Of Scandinavia · Air:Link 59300+2
Publicado
2017-03-26
·
Atualizado
2021-09-13
·
CVE-2016-10273
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3)
Jensen of Scandinavia AS Air:Link 5000AC (AL5000AC) version 1.13
Jensen of Scandinavia AS Air:Link 59300 (AL59300) version 1.04 (Rev. 4)
Description
Multiple stack buffer overflow vulnerabilities in Jensen of Scandinavia AS Air:Link devices allow remote attackers to execute arbitrary code or crash the web service via parameters of the "/goform/formWlanMP" endpoint, including
ateFunc, ateGain, ateTxCount, ateChan, ateRate, ateMacID, e2pTxPower1, e2pTxPower2, e2pTxPower3, e2pTxPower4, e2pTxPower5, e2pTxPower6, e2pTxPower7, e2pTx2Power1, e2pTx2Power2, e2pTx2Power3, e2pTx2Power4, e2pTx2Power5, e2pTx2Power6, e2pTx2Power7, ateTxFreqOffset, ateMode, ateBW, ateAntenna, e2pTxFreqOffset, e2pTxPwDeltaB, e2pTxPwDeltaG, e2pTxPwDeltaMix, e2pTxPwDeltaN, and readE2P.Recommendations
As a temporary workaround, consider disabling the "/goform/formWlanMP" endpoint until a patch is available.
Restrict access to the vulnerable parameters to minimize the risk of exploitation.
Avoid using the vulnerable parameters in the affected endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Air:Link 3G
Air:Link 5000Ac
Air:Link 59300