PT-2023-9252 · Actiontec · Actiontec Wcb6200Q

Logan Stratton · Published 2023-08-03 · Updated 2024-09-19 · CVE-2024-6145

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Actiontec WCB6200Q (affected versions not specified)

Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. The flaw exists within the HTTP server, where a crafted Cookie header in an HTTP request can trigger the use of a format specifier from a user-supplied string. An attacker can leverage this to execute code in the context of the HTTP server. Authentication is not required to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2024-05724

CVE-2024-6145

ZDI-24-808

Affected Products

Actiontec Wcb6200Q

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6145 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-808 · Security Note
• https://bdu.fstec.ru/vul/2024-05724 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6145 · Vendor Advisory
• https://t.me/cvenotify/83700 · Telegram Post
• https://t.me/cvenotify/95315 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024062126 · Note
• https://vuldb.com/?id.268923 · Note
• https://github.com/advisories/GHSA-grr9-3239-9wfq · Note