CVE-2024-7441

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This vulnerability affects the function read of the component httpd. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273526 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:vivotek:sd9364_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:vivotek:sd9364:-:*:*:*:*:*:*:*

History

06 Aug 2024, 17:43

Type Values Removed Values Added
CPE cpe:2.3:o:vivotek:sd9364_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:vivotek:sd9364:-:*:*:*:*:*:*:*
CVSS v2 : 9.0
v3 : 8.8
v2 : 9.0
v3 : 9.8
First Time Vivotek
Vivotek sd9364
Vivotek sd9364 Firmware
References () https://vuldb.com/?ctiid.273526 - () https://vuldb.com/?ctiid.273526 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.273526 - () https://vuldb.com/?id.273526 - Permissions Required, VDB Entry
References () https://vuldb.com/?submit.383842 - () https://vuldb.com/?submit.383842 - Third Party Advisory, VDB Entry
References () https://yjz233.notion.site/vivotek-SD9364-has-stack-buffer-overflow-vulnerability-in-httpd-c9dabd0511d04093865d1d75110429d1?pvs=4 - () https://yjz233.notion.site/vivotek-SD9364-has-stack-buffer-overflow-vulnerability-in-httpd-c9dabd0511d04093865d1d75110429d1?pvs=4 - Permissions Required
CWE CWE-119

05 Aug 2024, 12:41

Type Values Removed Values Added
Summary
  • (es) ** NO SOPORTADO CUANDO SE ASIGNÓ ** Se encontró una vulnerabilidad en Vivotek SD9364 VVTK-0103f. Ha sido declarada crítica. Esta vulnerabilidad afecta la función de lectura del componente httpd. La manipulación del argumento Content-Length conduce a un desbordamiento del búfer basado en pila. El ataque se puede iniciar de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-273526 es el identificador asignado a esta vulnerabilidad. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante. NOTA: Se contactó primeramente con el proveedor y se confirmó que el árbol de lanzamiento afectado ha llegado al final de su vida útil.

03 Aug 2024, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-03 18:15

Updated : 2024-08-07 17:15


NVD link : CVE-2024-7441

Mitre link : CVE-2024-7441

CVE.ORG link : CVE-2024-7441


JSON object : View

Products Affected

vivotek

  • sd9364
  • sd9364_firmware
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-121

Stack-based Buffer Overflow