CVE-2020-14511 Memory corruption in EDR-G902 and EDR-G903 Series Routers
A stack-based buffer overflow in the router's web server allows attackers to execute arbitrary code or cause a denial of service via a crafted cookie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14511?
CVE-2020-14511 is a critical memory corruption vulnerability in EDR-G902 and EDR-G903 Series Routers, published on 15 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server on the EDR-G902 and EDR-G903 Series Routers (versions prior to 5.4).
Which versions are affected by CVE-2020-14511?
It affects 4 products.
Products include Moxa Edr-G902-T Firmware, Moxa Edr-G902 Firmware, Moxa Edr-G903-T Firmware, Moxa Edr-G903 Firmware.
How do I fix CVE-2020-14511?
No fix has been published for CVE-2020-14511 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-14511 being exploited?
There is no known exploitation of CVE-2020-14511 in the wild and no public exploit code.
Sources
Also known as GHSA-3pp4-hx37-v55w.