CVE-2024-39815 Vonets WiFi Bridges Improper Check or Handling of Exceptional Conditions

Critical 9.4 Published 8 Aug 2024 Updated 21 Aug 2024

Unauthenticated remote attackers can crash the service via crafted HTTP requests, causing denial of service on Vonets industrial WiFi bridges.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-39815?

CVE-2024-39815 is a critical denial of service vulnerability in Vonets VAP11AC, published on 8 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper check or handling of exceptional conditions vulnerability affecting Vonets

industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated remote attacker to cause a denial of service. A specially-crafted HTTP request to pre-authentication resources can crash the service.

Weakness: CWE-703

Which versions are affected by CVE-2024-39815?

It affects 14 products.

Products include Vonets Vap11ac Firmware, Vonets Vap11g-300 Firmware, Vonets Vap11g-500 Firmware, Vonets Vap11g-500s Firmware, Vonets Vap11g Firmware, Vonets Vap11n-300 Firmware and 8 more.

How do I fix CVE-2024-39815?

No fix has been published for CVE-2024-39815 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-39815 being exploited?

There is no known exploitation of CVE-2024-39815 in the wild and no public exploit code.

Sources

Also known as GHSA-cv5w-c2ph-vhhw.