Integer Signedness Error in OpenWrt's uhttpd Affects Multiple Versions
CVE-2019-19945
7.5HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2019-19945?
The uhttpd web server in OpenWrt, specifically in versions up to 18.06.5 and 19.x until 19.07.0-rc2, is affected by an integer signedness error. This vulnerability enables out-of-bounds access to a heap buffer, potentially leading to server crashes. Attackers can exploit this issue by sending an HTTP POST request to a CGI script with 'Transfer-Encoding: chunked' accompanied by a large negative Content-Length value, causing the server to malfunction.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.