PT-2025-2193 · Newtec · Newtec Ntc2250+2

Published 2025-01-17 · Updated 2025-01-17 · CVE-2024-13503

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Newtec NTC2218, NTC2250, NTC2299 versions 1.0.1.1 through 2.2.6.19

Description A buffer overflow issue in the swdownload binary allows attackers to execute arbitrary code. The parse INFO function uses an unrestricted sscanf to read a string of an incoming network packet into a statically sized buffer, leading to a stack buffer overflow. This issue affects both PowerPC and ARM versions of the modems.

Recommendations For versions 1.0.1.1 through 2.2.6.19, consider disabling the parse INFO function or restricting the use of the swdownload binary until a patch is available. As a temporary workaround, restrict access to the swdownload binary to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-13503

Affected Products

Newtec Ntc2218

Newtec Ntc2250

Newtec Ntc2299

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-13503 · Security Note
• https://twitter.com/CveFindCom/status/1880254191584555438 · Twitter Post
• https://doi.org/10.1145/3643833.3656139 · Note
• https://twitter.com/CVEnew/status/1880384737576964163 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1880271165458895300 · Twitter Post
• https://t.me/cvedetector/15705 · Telegram Post
• https://youtube.com/watch?v=-pxmly8xeas · Note