Cisco Business Wireless Access Point Software up to 1.0.5.0 Web-based User Interface stack-based overflow

Summaryinfo

A vulnerability was found in Cisco Business Wireless Access Point Software up to 1.0.5.0. It has been rated as critical. The affected element is an unknown function of the component Web-based User Interface. The manipulation leads to stack-based overflow. This vulnerability is traded as CVE-2024-20336. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco Business Wireless Access Point Software up to 1.0.5.0 (Wireless LAN Software). This issue affects an unknown function of the component Web-based User Interface. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web-based user interface of Cisco Small Business Series Switches could allow an authenticated, remote attacker to execute arbitrary code on an affected device. The attacker must have valid administrative credentials for the device. This vulnerability is due to improper validation of requests that are sent to the web interface. An attacker could exploit this vulnerability by sending a crafted request through the web-based user interface. A successful exploit could allow the attacker to execute arbitrary code with root privileges on an affected device. {{value}} ["%7b%7bvalue%7d%7d"])}]]

The weakness was shared 03/06/2024 as cisco-sa-sb-wap-multi-85G83CRB. It is possible to read the advisory at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2024-20336 since 11/08/2023. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/05/2025).

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Cisco

Name

• Business Wireless Access Point Software

Version

• 1.0.0.3
• 1.0.0.4
• 1.0.0.5
• 1.0.0.7
• 1.0.1.3
• 1.0.1.5
• 1.0.1.7
• 1.0.2.0
• 1.0.3.1
• 1.0.4.3
• 1.0.4.4
• 1.0.5.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion