CVE-2019-8985
CRITICALNetis WF2411 and WF2880 Firmware - Unauthenticated Stack-Based Buffer Overflow via HTTP Authorization Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-8985. PoCs published by Squirre17.
AI-analyzed exploit summary This repository contains a working exploit for CVE-2019-8985, targeting Netis WF2411 routers. The exploit leverages a buffer overflow in the HTTP authentication header to achieve remote code execution (RCE) via a ROP chain, with payloads including a simple command execution and a reverse shell.
Description
On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.
Exploits (1)
This repository contains a working exploit for CVE-2019-8985, targeting Netis WF2411 routers. The exploit leverages a buffer overflow in the HTTP authentication header to achieve remote code execution (RCE) via a ROP chain, with payloads including a simple command execution and a reverse shell.
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H