PT-2024-13829 · Realtek · Realtek Rtl819X Jungle Sdk

Francesco Benvenuto · Published 2024-07-08 · Updated 2024-07-11 · CVE-2023-49867

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Realtek rtl819x Jungle SDK version 3.4.11

Description A stack-based buffer overflow vulnerability exists in the boa formWsc functionality. This can be triggered by a specially crafted series of HTTP requests, potentially leading to remote code execution. An attacker can exploit this issue by sending a series of HTTP requests.

Recommendations For Realtek rtl819x Jungle SDK version 3.4.11, consider disabling the boa formWsc functionality until a patch is available to prevent potential remote code execution. Restrict access to the vulnerable functionality to minimize the risk of exploitation. Avoid using the vulnerable SDK version in production environments until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2023-49867

Affected Products

Realtek Rtl819X Jungle Sdk

References · 10

• https://osv.dev/vulnerability/CVE-2023-49867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49867 · Security Note
• https://t.me/cvenotify/85380 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1904 · Note
• https://twitter.com/VulmonFeeds/status/1810386182427062669 · Twitter Post
• https://t.me/cvedetector/201 · Telegram Post
• https://twitter.com/CVEnew/status/1810337819744784675 · Twitter Post
• https://t.me/cvenotify/85878 · Telegram Post
• https://twitter.com/cracbot/status/1810554610618392801 · Twitter Post
• https://twitter.com/cracbot/status/1811279328589889975 · Twitter Post