CVE-2024-20336 Memory corruption in Cisco Business Wireless Access Point Software
Authenticated attackers can execute arbitrary code as root via buffer overflow in the web interface of Cisco Small Business Wireless APs.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-20336?
CVE-2024-20336 is a medium-severity memory corruption vulnerability in Cisco Business Wireless Access Point Software, published on 6 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the web-based user interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attacker to perform buffer overflow attacks against an affected device. In order to exploit this vulnerability, the attacker must have valid administrative credentials for the device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system.
Weakness: CWE-121
Which versions are affected by CVE-2024-20336?
It affects 12 products.
Products include Cisco Wap121 Firmware, Cisco Wap125 Firmware, Cisco Wap131 Firmware, Cisco Wap150 Firmware, Cisco Wap320 Firmware, Cisco Wap321 Firmware and 6 more.
How do I fix CVE-2024-20336?
No fix has been published for CVE-2024-20336 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-20336 being exploited?
There is no known exploitation of CVE-2024-20336 in the wild and no public exploit code.
Other vulnerabilities in Cisco Business Wireless Access Point Software
Sources
Also known as GHSA-5v2f-93mx-7r24.