CWE-121

Stack-based Buffer Overflow

VariantDraftLikelihood: High

Description

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (3,805)

page 23 of 191

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-39281	Insyde InsydeH2O	Cri	0.64	9.8	0.00	Nov 1, 2023	A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.
CVE-2023-46564	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.
CVE-2023-46563	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.
CVE-2023-46562	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.
CVE-2023-46560	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.
CVE-2023-46559	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr.
CVE-2023-46553	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl.
CVE-2023-46552	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP.
CVE-2023-43492	Weintek cMT3000	Cri	0.64	9.8	0.01	Oct 19, 2023	In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
CVE-2023-38584	Weintek cMT3000	Cri	0.64	9.8	0.01	Oct 19, 2023	In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
CVE-2023-45984	Totolink X5000R	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
CVE-2023-36950	Totolink X5000R	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-36947	Totolink X5000R	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-34426	Yifan Yf325	Cri	0.64	9.8	0.01	Oct 11, 2023	A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.
CVE-2023-34365	Yifan Yf325	Cri	0.64	9.8	0.01	Oct 11, 2023	A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a buffer overflow. An attacker can send a network request to trigger this vulnerability.
CVE-2023-33028	Qualcomm WLAN Firmware	Cri	0.64	9.8	0.01	Oct 3, 2023	Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
CVE-2023-44019	Tenda Ac10	Cri	0.64	9.8	0.01	Sep 27, 2023	Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the mac parameter in the GetParentControlInfo function.
CVE-2023-44017	Tenda Ac10	Cri	0.64	9.8	0.01	Sep 27, 2023	Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.
CVE-2023-44016	Tenda Ac10	Cri	0.64	9.8	0.01	Sep 27, 2023	Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
CVE-2023-44015	Tenda Ac10	Cri	0.64	9.8	0.01	Sep 27, 2023	Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the schedEndTime parameter in the setSchedWifi function.

CVE-2023-39281CriNov 1, 2023
Insyde
InsydeH2O
risk 0.64cvss 9.8epss 0.00
A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.
CVE-2023-46564CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.
CVE-2023-46563CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.
CVE-2023-46562CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.
CVE-2023-46560CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.
CVE-2023-46559CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr.
CVE-2023-46553CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl.
CVE-2023-46552CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP.
CVE-2023-43492CriOct 19, 2023
Weintek
cMT3000
risk 0.64cvss 9.8epss 0.01
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
CVE-2023-38584CriOct 19, 2023
Weintek
cMT3000
risk 0.64cvss 9.8epss 0.01
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
CVE-2023-45984CriOct 16, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
CVE-2023-36950CriOct 16, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-36947CriOct 16, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-34426CriOct 11, 2023
Yifan
Yf325
risk 0.64cvss 9.8epss 0.01
A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.
CVE-2023-34365CriOct 11, 2023
Yifan
Yf325
risk 0.64cvss 9.8epss 0.01
A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a buffer overflow. An attacker can send a network request to trigger this vulnerability.
CVE-2023-33028CriOct 3, 2023
Qualcomm
WLAN Firmware
risk 0.64cvss 9.8epss 0.01
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
CVE-2023-44019CriSep 27, 2023
Tenda
Ac10
risk 0.64cvss 9.8epss 0.01
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the mac parameter in the GetParentControlInfo function.
CVE-2023-44017CriSep 27, 2023
Tenda
Ac10
risk 0.64cvss 9.8epss 0.01
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.
CVE-2023-44016CriSep 27, 2023
Tenda
Ac10
risk 0.64cvss 9.8epss 0.01
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
CVE-2023-44015CriSep 27, 2023
Tenda
Ac10
risk 0.64cvss 9.8epss 0.01
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the schedEndTime parameter in the setSchedWifi function.