CVE-2017-10814

Vulnerability

A buffer overflow vulnerability (CWE-119) exists in CG-WLR300NM wireless LAN router firmware version 1.90 and earlier [1]. The flaw resides in an unspecified component reachable through the administrative console [1]. The product is end-of-life and no longer supported [1].

Exploitation

An attacker must be on the same adjacent network and have administrative credentials to access the device's management interface [1]. The attack complexity is low; no user interaction is required beyond the authenticated session. The exact sequence of inputs triggering the overflow has not been publicly disclosed [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the device with the full privileges of the administrative console [1]. This can lead to complete compromise of confidentiality, integrity, and availability of the router and potentially the network it serves [1].

Mitigation

Corega Inc. has no plan to release a fix because the CG-WLR300NM is end-of-life and no longer supported [1]. The only mitigation advised by JPCERT/CC is to stop using the device entirely and replace it with a supported alternative [1].