CVE-2019-8985: Buffer Overflow
First published: Thu Feb 21 2019(Updated: )
On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netis-systems Wf2411 Firmware | =2.1.36123 | |
| Netis-systems Wf2411 | ||
| Netis-systems Wf2880 Firmware | =2.1.36123 | |
| Netis-systems Wf2880 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Netis WF2411 vulnerability?
The vulnerability ID for this Netis WF2411 vulnerability is CVE-2019-8985.
What is the severity of CVE-2019-8985?
The severity of CVE-2019-8985 is critical with a CVSS score of 9.8.
Which Netis WF2xxx devices are affected by CVE-2019-8985?
Netis WF2411 and possibly WF2411 through WF2880 devices are affected by CVE-2019-8985.
How can CVE-2019-8985 be exploited?
CVE-2019-8985 can be exploited through a stack-based buffer overflow that does not require authentication, leading to denial of service (device restart) or remote code execution.
What is the fix for CVE-2019-8985?
There is no official fix for CVE-2019-8985 at the moment, but it is recommended to update the firmware of the affected Netis devices to a patched version once it becomes available.
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/event
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/netis-systems
- canonical/netis-systems wf2411 firmware
- version/netis-systems wf2411 firmware/2.1.36123
- canonical/netis-systems wf2411
- canonical/netis-systems wf2880 firmware
- version/netis-systems wf2880 firmware/2.1.36123
- canonical/netis-systems wf2880