PT-2023-9252 · Actiontec · Actiontec Wcb6200Q

Logan Stratton · Publicado 2023-08-03 · Atualizado 2024-09-19 · CVE-2024-6145

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Actiontec WCB6200Q (affected versions not specified)

Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. The flaw exists within the HTTP server, where a crafted Cookie header in an HTTP request can trigger the use of a format specifier from a user-supplied string. An attacker can leverage this to execute code in the context of the HTTP server. Authentication is not required to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

BDU:2024-05724

CVE-2024-6145

ZDI-24-808

Produtos afetados

Actiontec Wcb6200Q

Referências · 9

• https://t.me/cvenotify/83700 · Publicação no Telegram
• https://t.me/cvenotify/95315 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-6145 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-24-808 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2024062126 · Nota
• https://bdu.fstec.ru/vul/2024-05724 · Nota de Segurança
• https://vuldb.com/?id.268923 · Nota
• https://osv.dev/vulnerability/CVE-2024-6145 · Aviso do Fabricante
• https://github.com/advisories/GHSA-grr9-3239-9wfq · Nota