Buffer Overflow vulnerability in Skyworth Router

Vulnerability

The vulnerability exists in the Skyworth Router CM5100, version 4.1.1.24, at the web interface. The Add Downstream Frequency parameter lacks sufficient validation of user-supplied input, allowing specially crafted values to be processed. This bug is remotely accessible without authentication according to the advisory. [1]

Exploitation

A remote attacker can send a crafted HTTP request to the router's web interface, supplying malicious input to the Add Downstream Frequency parameter. No prior authentication is required; the attacker needs only network connectivity to the router's management interface. The crafted input triggers the vulnerable code path leading to a denial of service condition. [1]

Impact

Successful exploitation results in a Denial of Service (DoS) attack on the targeted system. The router may become unresponsive or crash, causing loss of network connectivity for users. The CIA outcome is primarily availability impact, with no indication of data compromise or privilege escalation. [1]

Mitigation

As of the publication date (January 2024), the advisory does not mention a fixed version or patch availability. Users are advised to monitor vendor updates and apply any security fixes when released. There is no known workaround. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog per the available information. [1]