CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-11237

Critical Severity
Tp-link
SVRS
84/100

CVSSv3
9.8/10

EPSS
0.00421/1

CVE-2024-11237 is a critical vulnerability in TP-Link VN020 F3v(T) TT_V6.2.1021, specifically affecting the DHCP DISCOVER Packet Parser. This stack-based buffer overflow is triggered by manipulating the hostname argument, allowing for remote attacks. With a SOCRadar Vulnerability Risk Score (SVRS) of 84, this CVE demands immediate attention and remediation efforts. The public availability of an exploit significantly increases the risk of exploitation. This vulnerability could allow attackers to execute arbitrary code, compromise affected systems, and potentially gain full control of the device. Due to its severity and the ease of remote exploitation, organizations using the affected TP-Link devices must prioritize patching or mitigating this vulnerability to prevent potential security breaches. The high SVRS and the 'In The Wild' tag mean that attackers are actively attempting to exploit this weakness.

In The Wild
CVSS:3.1
AV:N
AC:L
PR:N
UI:N
S:U
C:H
I:H
A:H
2024-11-15

2024-11-19
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-11237 is a newly discovered vulnerability with limited information available at this time. While the CVSS score is currently 0, the SOCRadar Vulnerability Risk Score (SVRS) stands at 30, indicating a moderate risk. This signifies that the vulnerability has the potential to be exploited, warranting further investigation and appropriate security measures.

Key Insights

  1. Limited Information: Due to the recent publication of CVE-2024-11237, a comprehensive understanding of its technical details, affected systems, and potential impact is currently unavailable.
  2. "In The Wild" Tag: The "In The Wild" tag suggests that the vulnerability is actively exploited by hackers. This implies that attackers are leveraging this vulnerability to compromise systems and potentially steal data or disrupt operations.
  3. SVRS Indicates Moderate Risk: Despite the lack of detailed information, the SVRS of 30 suggests that the vulnerability has the potential for significant impact. While not critical, it is important to take proactive steps to mitigate this risk.
  4. Potential for Exploitation: The combination of limited information and "In The Wild" status suggests that attackers are actively exploiting this vulnerability without waiting for detailed public disclosure. This necessitates immediate attention and action from organizations.

Mitigation Strategies

  1. Stay Updated: Continuously monitor for updates on the CVE-2024-11237 vulnerability. As more information becomes available, implement appropriate security patches and updates promptly.
  2. Threat Intelligence: Leverage threat intelligence feeds and resources from reputable providers to stay informed of any emerging attack patterns or indicators of compromise related to this vulnerability.
  3. Network Segmentation: Implement network segmentation to limit the impact of potential breaches. Isolate critical systems and data to prevent lateral movement within the network.
  4. Enhanced Monitoring: Increase security monitoring and logging capabilities to detect any suspicious activity that could indicate exploitation of CVE-2024-11237.

Additional Information

If you have additional queries regarding this incident, please utilize the "Ask to Analyst" feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

DHCP Vulnerability in TP-Link Lets Attackers Takeover Routers Remotely – PoC Released
Balaji N2024-11-15
DHCP Vulnerability in TP-Link Lets Attackers Takeover Routers Remotely – PoC Released | A critical security vulnerability has been found in TP-Link VN020-F3v(T) routers with firmware version TT_V6.2.1021 Attackers could take over the devices remotely, leading to DoS attacks or even RCE attacks. The vulnerability, cataloged as CVE-2024-11237, allows attackers to exploit a stack-based buffer overflow by sending specially crafted DHCP DISCOVER packets, which can cause the router […] The post DHCP Vulnerability in TP-Link
cybersecuritynews.com
rss
forum
news
Critical TP-Link DHCP Vulnerability Let Attackers Execute Arbitrary Code Remotely
Gurubaran2024-11-15
Critical TP-Link DHCP Vulnerability Let Attackers Execute Arbitrary Code Remotely | A critical security flaw has been uncovered in certain TP-Link routers, potentially allowing malicious actors to remotely compromise affected devices. The vulnerability, identified as CVE-2024-11237, affects TP-Link VN020 F3v(T) routers running firmware version TT_V6.2.1021, which are primarily deployed through Tunisie Telecom and Topnet ISPs. Similar variants of the router used in Algeria and Morocco are […] The post Critical TP-Link DHCP Vulnerability Let Attackers Execute Arbitrary
gbhackers.com
rss
forum
news
CVE-2024-11237 | TP-Link VN020 F3v(T) TT_V6.2.1021 DHCP DISCOVER Packet Parser hostname TP-Thumper stack-based overflow
vuldb.com2024-11-15
CVE-2024-11237 | TP-Link VN020 F3v(T) TT_V6.2.1021 DHCP DISCOVER Packet Parser hostname TP-Thumper stack-based overflow | A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. This vulnerability is
vuldb.com
rss
forum
news

Social Media

🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability affecting TP-Link products. Exploited versions include several models. Users are urged to update firmware immediately to mitigate risks. For more details, check the remediation guide: https://t.co/GMVZnlls6a
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability affecting TP-Link devices. Exploited in multiple versions, this flaw poses serious security risks. 🛡️ Remediation is crucial! Check out the details and mitigation steps here: https://t.co/GMVZnlls6a
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability affecting TP-Link products. Exploited in various versions, this flaw poses significant risks. 🛡️ Ensure your devices are updated and patched immediately. For more details, check out the remediation guide:
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability in TP-Link products. Affects multiple versions. Users are urged to update to the latest firmware immediately to mitigate risks. For more details, check out the remediation guide: https://t.co/GMVZnlls6a
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability in TP-Link products. Affects multiple versions. Users are urged to update firmware immediately to mitigate risks. For more details and remediation steps, check out the GitHub link: https://t.co/GMVZnlls6a
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability affecting TP-Link products. Exploited in various versions, this flaw poses significant risks. Remediation is crucial! Check out the details and mitigation steps here: https://t.co/GMVZnlls6a #CyberSecurity
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability affecting TP-Link products. Exploited in specific versions, this flaw poses serious security risks. 🚫 Ensure your devices are updated and patched to mitigate potential threats. For more details, check:
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability affecting TP-Link devices. Exploited in specific versions, this flaw poses significant security risks. Ensure your devices are updated and patched. For remediation details, check out the GitHub link:
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - Critical vulnerability in TP-Link products. Affects multiple versions. Ensure your devices are updated to the latest firmware to mitigate risks. For detailed remediation steps, check out the GitHub link: https://t.co/GMVZnlls6a
0
0
0
🚨 CVE-2024-11237 (Published: 2024-11-15) - A critical vulnerability affecting TP-Link devices. Exploited in specific versions, this flaw poses serious risks. 🛡️ Remediation is crucial! Check out the proof of concept here: https://t.co/VezC8tB7gK #CyberSecurity #TPLink
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
OSTp-linkvn020-f3v\(t\)_firmware

References

ReferenceLink
[email protected]https://github.com/Zephkek/TP-Thumper
[email protected]https://github.com/Zephkek/TP-Thumper/blob/main/poc.c
[email protected]https://vuldb.com/?ctiid.284672
[email protected]https://vuldb.com/?id.284672
[email protected]https://vuldb.com/?submit.438408
[email protected]https://www.tp-link.com/
GITHUBhttps://github.com/Zephkek/TP-Thumper
GITHUBhttps://github.com/Zephkek/TP-Thumper/blob/main/poc.c

CWE Details

CWE IDCWE NameDescription
CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CWE-787Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence