PT-2023-7289 · Unknown · Weston Embedded Uc-Http

Kelly Leuschner · Published 2023-11-14 · Updated 2023-11-17 · CVE-2023-28379

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Weston Embedded uC-HTTP version 3.01.01

Description A memory corruption issue exists in the HTTP Server form boundary functionality. This can be triggered by a specially crafted network packet, potentially leading to code execution. An attacker can exploit this by sending a malicious packet.

Recommendations For Weston Embedded uC-HTTP version 3.01.01, consider disabling the HTTP Server form boundary functionality until a patch is available to prevent potential code execution. Restrict access to the HTTP server to minimize the risk of exploitation. Avoid using the vulnerable version until an update or fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2023-08317

CVE-2023-28379

Affected Products

Weston Embedded Uc-Http

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1738 · Exploit
• https://osv.dev/vulnerability/CVE-2023-28379 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08317 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28379 · Security Note
• https://twitter.com/CVEnew/status/1724358127921819816 · Twitter Post
• https://t.me/cvenotify/60650 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1724396218829180974 · Twitter Post