PT-2024-6402 · Openwrt · Openwrt

Published 2024-07-31 · Updated 2024-07-31

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenWrt (affected versions not specified)

Description The issue is related to the implementation of the SAE H2E authentication protocol in the OpenWrt embedded operating system, which is affected by errors in handling input data. This could allow a remote attacker to downgrade the version of the protocol used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2024-07487

Affected Products

Openwrt

References · 3

• https://bdu.fstec.ru/vul/2024-07487 · Security Note
• https://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt · Note
• https://lists.openwrt.org/pipermail/openwrt-announce/2024-September/000058.html · Note