Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2024-5242

7.5HIGH

Key Information:

Vendor

Tp-link
Status
Omada Er605
Vendor
CVE Published:
23 May 2024

What is CVE-2024-5242?

The TP-Link Omada ER605 routers are susceptible to a stack-based buffer overflow vulnerability that allows remote code execution by network-adjacent attackers. This flaw occurs within the device's handling of Dynamic Domain Name System (DDNS) error codes, stemming from inadequate validation of user-supplied data length before copying it to a fixed-length buffer. When attackers exploit this vulnerability, they gain the ability to execute arbitrary code with root privileges, provided that the devices are configured to use the Comexe DDNS service.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Omada ER605 2.6_2.2.2 Build 20231017

References

https://www.zerodayinitiative.com/advisories/ZDI-24-501/
x_research-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.