CVE-2024-20017 — Improper Input Validation in Software Development KIT

CWE-20 — Improper Input ValidationCWE-787 — Out-of-bounds WriteCWE-77 — Command Injection4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
68.2%
top 1.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mediatek Software Development KITOpenwrt
Timeline
PublishedMar 4

Description

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDopenwrt/openwrt19.07.0, 21.02.0+1

🔴Vulnerability Details

2
CVEList
CVE-2024-20017: In wlan service, there is a possible out of bounds write due to improper input validation↗2024-03-04
▶
GHSA
GHSA-qr26-2mpm-7j4x: In wlan service, there is a possible out of bounds write due to improper input validation↗2024-03-04
▶

📋Vendor Advisories

1
CISA
D-Link DSL-2750B Devices Command Injection Vulnerability↗2024-01-08
▶
CVE-2024-20017 — Improper Input Validation | cvebase