CVE ID | CVE-2023-35803 |
CVSS SCORE | 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
AFFECTED VENDORS |
Extreme Networks |
AFFECTED PRODUCTS |
AP410C |
VULNERABILITY DETAILS |
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Extreme Networks AP410C routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ah_acsd service, which listens on TCP port 5916 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. |
ADDITIONAL DETAILS |
Extreme Networks has issued an update to correct this vulnerability. More details can be found at:
https://extremeportal.force.com/ExtrArticleDetail?an=000112742 |
DISCLOSURE TIMELINE |
|
CREDIT | Victorien Molle - Biche T\xc3\xa9l\xc3\xa9com |