PT-2024-27115 · Nodemcu · Nodemcu

Crispy-Fried-Chicken · Published 2024-11-29 · Updated 2024-12-04 · CVE-2024-36671

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nodemcu versions prior to 3.0.0-release 20240225

Description The issue is related to an integer overflow in the getnum function located at /modules/struct.c. This overflow can be exploited, potentially leading to unintended behavior. No information is provided about the estimated number of affected devices or real-world incidents.

Recommendations For versions prior to 3.0.0-release 20240225, update to version 3.0.0-release 20240225 or later to resolve the issue. As a temporary workaround, consider restricting access to the getnum function until a patch is applied.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2024-36671

Affected Products

Nodemcu

References · 8

• https://osv.dev/vulnerability/CVE-2024-36671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36671 · Security Note
• https://github.com/nodemcu/nodemcu-firmware/pull/3635 · Note
• https://github.com/nodemcu/nodemcu-firmware/commit/193fe3593eb1537667179089535cdb7457327887#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721 · Note
• https://github.com/nodemcu/nodemcu-firmware/issues/3626 · Note
• https://github.com/nodemcu/nodemcu-firmware/pull/3634 · Note
• https://github.com/nodemcu/nodemcu-firmware/pull/3633 · Note
• https://twitter.com/CVEnew/status/1862515715984498888 · Twitter Post