CVE-2014-0355 in Wireless N300 NetUSB
Summary
by MITRE
Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/10/2026
The CVE-2014-0355 vulnerability represents a critical stack-based buffer overflow issue affecting ZyXEL Wireless N300 NetUSB NBG-419N routers running firmware version 1.00(BFQ.6)C0. This vulnerability stems from inadequate input validation within multiple functions of the router's firmware, creating multiple attack vectors that could enable remote code execution. The flaw manifests through several distinct code paths that process weather data and UPnP commands, making it particularly dangerous as it can be exploited through various communication channels. The vulnerability falls under CWE-121 Stack-based Buffer Overflow, which is classified as a fundamental memory safety issue where data written to a buffer exceeds its allocated size, potentially corrupting adjacent memory locations.
The technical exploitation occurs through multiple attack surfaces within the router's processing functions. The primary attack vector involves a malformed yweather:condition element within forecastrss files processed by the checkWeather function, where a lengthy temp attribute triggers the buffer overflow. Additionally, the detectWeather function is vulnerable to buffer overflows through the WeatherCity or WeatherDegree variables, while three UPnP-related functions UpnpAddRunRLQoS, UpnpDeleteRunRLQoS, and UpnpDeletePortCheckType present additional attack surfaces. The final vector involves the SET COUNTRY udps command which can be manipulated to trigger similar buffer overflow conditions. These functions collectively represent a comprehensive attack surface that allows an attacker to overwrite stack memory and potentially redirect execution flow.
The operational impact of this vulnerability is severe as it enables remote code execution without requiring authentication, making it particularly dangerous for networked environments. An attacker positioned in a man-in-the-middle position can exploit these vulnerabilities to inject malicious code into the router's memory, potentially gaining full control over the device. This compromise could lead to complete network infiltration, as the router serves as a gateway for network traffic. The vulnerability's impact extends beyond the individual device to potentially compromise the entire network infrastructure, as routers often serve as critical network control points. The low attack complexity combined with high impact makes this vulnerability particularly attractive to threat actors.
Mitigation strategies should focus on immediate firmware updates from ZyXEL, as the vendor would have released patches addressing these specific buffer overflow conditions. Network administrators should implement network segmentation and monitoring to detect anomalous traffic patterns that might indicate exploitation attempts. The principle of least privilege should be enforced by restricting UPnP functionality and disabling unnecessary services on the affected devices. Additionally, implementing intrusion detection systems capable of identifying malformed weather data or UPnP commands can help detect exploitation attempts. Organizations should also consider network access controls and firewall rules to limit exposure to external threats. This vulnerability highlights the importance of secure coding practices and input validation, particularly in embedded systems where memory constraints and security considerations often conflict. The ATT&CK framework categorizes this vulnerability under T1059 Command and Scripting Interpreter and T1203 Exploitation for Client Execution, emphasizing the need for comprehensive defensive measures.