CVE-2025-50464: Buffer Overflow
A buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5.04. The vulnerability arises due to the unsafe use of the strcpy function to copy attacker-controlled data from the CONTENTTYPE HTTP header into a fixed-size stack buffer (v8, allocated 8 bytes) without bounds checking. Since this operation occurs before authentication logic is executed, the vulnerability is exploitable pre-authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50464?
CVE-2025-50464 is classified as a critical severity vulnerability due to its potential to allow remote code execution through a buffer overflow.
How do I fix CVE-2025-50464?
To fix CVE-2025-50464, update the iptime NAS firmware to a version beyond 1.5.04 where the vulnerability is addressed.
Who is affected by CVE-2025-50464?
CVE-2025-50464 affects users of the iptime NAS firmware version 1.5.04.
What type of vulnerability is CVE-2025-50464?
CVE-2025-50464 is a buffer overflow vulnerability related to the unsafe handling of input data.
What components are involved in CVE-2025-50464?
CVE-2025-50464 specifically involves the upload.cgi module of the iptime NAS firmware.