PT-2020-2038 · Openwrt · Openwrt+1

Jo-Philipp Wich + 1 · Published 2020-03-16 · Updated 2023-05-24 · CVE-2020-7248

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenWrt versions 18.06.0 through 18.06.6 OpenWrt versions 19.0.0 through 19.07.0

Description The issue is related to a tagged binary data JSON serialization problem in the libubox library of OpenWrt, which may cause a stack-based buffer overflow. This could potentially allow a remote attacker to execute arbitrary code.

Recommendations For OpenWrt versions 18.06.0 through 18.06.6, update to version 18.06.7 or later. For OpenWrt versions 19.0.0 through 19.07.0, update to version 19.07.1 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2020-01663

CVE-2020-7248

Affected Products

Openwrt

Libubox

References · 10

• https://github.com/openwrt/openwrt/commits/master · Patch
• https://bdu.fstec.ru/vul/2020-01663 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-7248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-7248#range-4512438 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20200326.5.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2020-7248 · Vendor Advisory
• https://openwrt.org/advisory/2020-01-31-2 · Vendor Advisory
• https://t.me/cvenotify/1794 · Telegram Post
• https://t.me/cvenotify/35681 · Telegram Post
• https://t.me/cvenotify/51044 · Telegram Post