CVE-2024-57471
Published: 14 January 2025
Description
H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless network processing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
Security Summary
CVE-2024-57471, published on 2025-01-14, is a buffer overflow vulnerability (CWE-120) in H3C N12 V100R005 due to insufficient length verification in the 2.4G wireless network processing function. The flaw resides in the web interface component, specifically accessible via the /bin/webs endpoint.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it exploitable over the network with low complexity, no privileges, no user interaction, and unchanged scope. Remote attackers can trigger it by sending a specially crafted POST request to /bin/webs on a vulnerable device, potentially causing a denial-of-service crash or remote code execution with arbitrary command execution.
Mitigation guidance is available in the vendor advisory at http://h3c.com and further technical details, including a proof-of-concept, in the GitHub gist at https://gist.github.com/XiaoCurry/88a43c9a68694941221eb7592da39d4c.
Details
- CWE(s)