WyreStorm Apollo VX20 up to 1.3.57 GET Request /device/reboot denial of service

Summaryinfo

A vulnerability was found in WyreStorm Apollo VX20 up to 1.3.57. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the file /device/reboot of the component GET Request Handler. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2024-25736. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in WyreStorm Apollo VX20 up to 1.3.57. It has been rated as problematic. This issue affects an unknown code block of the file /device/reboot of the component GET Request Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request.

The advisory is shared at packetstormsecurity.com. The identification of this vulnerability is CVE-2024-25736 since 02/11/2024. The exploitation is known to be easy. The attack may be initiated remotely. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 1.3.58 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51815). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• WyreStorm

Name

• Apollo VX20

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 1.3.15
• 1.3.16
• 1.3.17
• 1.3.18
• 1.3.19
• 1.3.20
• 1.3.21
• 1.3.22
• 1.3.23
• 1.3.24
• 1.3.25
• 1.3.26
• 1.3.27
• 1.3.28
• 1.3.29
• 1.3.30
• 1.3.31
• 1.3.32
• 1.3.33
• 1.3.34
• 1.3.35
• 1.3.36
• 1.3.37
• 1.3.38
• 1.3.39
• 1.3.40
• 1.3.41
• 1.3.42
• 1.3.43
• 1.3.44
• 1.3.45
• 1.3.46
• 1.3.47
• 1.3.48
• 1.3.49
• 1.3.50
• 1.3.51
• 1.3.52
• 1.3.53
• 1.3.54
• 1.3.55
• 1.3.56
• 1.3.57

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion