Medium severity · published Apr 21, 2023
CVE-2023-29908
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm
4.9
CVSS
0.8%
EPSS
No
On KEV
Description
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
Magic R200 Firmware · H3c
r200v100r004 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29908
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29908
hackmd.io
https://hackmd.io/%400dayResearch/Ski-S20J2
More from Magic R200 Firmware
9.8
CVE-2022-34610
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app
9.8
CVE-2022-34609
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /doping.asp
9.8
CVE-2022-34608
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ajaxmsg parameter at /AJAX/ajaxget
9.8
CVE-2022-34607
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp
9.8
CVE-2022-34606
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditvsList parameter at /dotrace.asp