Actiontec WCB6200Q 1.2L.03.5 HTTP Server uh_get_postdata_withupload stack-based overflow

Summaryinfo

A vulnerability described as critical has been identified in Actiontec WCB6200Q 1.2L.03.5. The impacted element is the function uh_get_postdata_withupload of the component HTTP Server. Executing a manipulation can lead to stack-based overflow. The identification of this vulnerability is CVE-2024-6146. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Actiontec WCB6200Q 1.2L.03.5 and classified as very critical. This vulnerability affects the function uh_get_postdata_withupload of the component HTTP Server. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP server. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HTTP server. Was ZDI-CAN-21418.

The advisory is shared for download at zerodayinitiative.com. This vulnerability was named CVE-2024-6146 since 06/18/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/19/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Actiontec

Name

• WCB6200Q

Version

• 1.2L.03.5

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion