Threats tagged 'ghsa-q9hf-9722-wj88'

Cudy TR3000 devices running firmware versions before 2.5.42 have a stack buffer overflow vulnerability in the obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter. This occurs because the stored passphrase is copied into a fixed 4,096-byte stack buffer using strcpy() without length validation. A malicious or compromised ACS can set a passphrase longer than the buffer size (e.g., 5,000 bytes) via SetParameterValues, causing a buffer overflow and crashing obuspa, resulting in denial of service.