PT-2023-7288 · Unknown · Weston Embedded Uc-Http

Kelly Leuschner · CVE-2023-28391 · Published 2023-11-14 · Updated 2023-11-17

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-HTTP version 3.01.01

Description A memory corruption issue exists in the HTTP Server header parsing functionality. This can be exploited by sending specially crafted network packets, potentially leading to code execution. An attacker can trigger this issue by sending a malicious packet.

Recommendations For version 3.01.01, consider disabling the HTTP Server header parsing functionality until a patch is available. Restrict access to the HTTP server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-08316

CVE-2023-28391

Affected Products

Weston Embedded Uc-Http

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28391.json · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1732 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28391 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28391 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08316 · Security Note
• https://twitter.com/CVEnew/status/1724358126030164452 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1724396978119839985 · Twitter Post