PT-2023-7291 · Unknown · Weston Embedded Uc-Http

Kelly Leuschner · Publicado 2023-11-14 · Atualizado 2023-11-17 · CVE-2023-27882

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-HTTP version 3.01.01

Description A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality. This issue can be triggered by a specially crafted network packet, potentially leading to code execution. An attacker can exploit this by sending a malicious packet.

Recommendations For version 3.01.01, consider disabling the HTTP Server form boundary functionality until a patch is available to prevent potential code execution. Restrict access to the HTTP Server to minimize the risk of exploitation. Avoid using the vulnerable functionality in the HTTP Server form boundary until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-122

Identificadores relacionados

BDU:2023-08319

CVE-2023-27882

Produtos afetados

Weston Embedded Uc-Http

Referências · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1733 · Exploit
• https://bdu.fstec.ru/vul/2023-08319 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1724396471892509039 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-27882 · Nota de Segurança
• https://t.me/cvenotify/60649 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1724358126961357137 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-27882 · Aviso do Fabricante