PT-2024-25696 · Bpq32 · Bpq32

Published 2024-08-26 · Updated 2024-08-30 · CVE-2024-34087

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BPQ32 version 6.0.24.1

Description The issue is related to an SEH-based buffer overflow in the BPQ32 HTTP Server, allowing remote attackers with access to the Web Terminal to achieve remote code execution via an HTTP POST /TermInput request.

Recommendations For BPQ32 version 6.0.24.1, upgrade to version 6.0.24.2 to mitigate risks. As a temporary workaround, consider restricting access to the Web Terminal to minimize the risk of exploitation. Avoid using the vulnerable HTTP POST /TermInput request until the issue is resolved.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-34087

Affected Products

Bpq32

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-34087 · Security Note
• https://twitter.com/transilienceai/status/1829198776176660891 · Twitter Post
• https://twitter.com/transilienceai/status/1829585136536436925 · Twitter Post
• https://twitter.com/cracbot/status/1829761119659180161 · Twitter Post
• https://twitter.com/cracbot/status/1829398733555155185 · Twitter Post
• https://youtube.com/%40ModernHam · Note
• https://twitter.com/CVEnew/status/1828092554069361009 · Twitter Post
• https://groups.io/g/bpq32 · Note
• https://cantab.net/users/john.wiseman/Documents · Note
• https://twitter.com/transilienceai/status/1829198785060196859 · Twitter Post
• https://twitter.com/transilienceai/status/1829585126348472498 · Twitter Post
• https://twitter.com/transilienceai/status/1829198766135497071 · Twitter Post
• https://twitter.com/transilienceai/status/1829585114336051604 · Twitter Post
• https://themodernham.com/bbs-hacking-discovering-rce-within-bpq32-seh-based-buffer-overflow · Note
• https://twitter.com/transilienceai/status/1829585120845545813 · Twitter Post