CVE-2019-8985 - CVE House
Back to Database
Status published Critical CVE-2019-8985

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx...

Vulnerability Description

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-8985

Credits & Attribution

No credits recorded in the NVD database.

References

More from netis-systems

View All →
CVE-2021-26747
Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter...
Critical 9.8
CVE-2020-8946
Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute...
High 8.8
CVE-2019-20076
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username...
Medium 6.1
CVE-2019-20075
On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic)....
Medium 6.1
CVE-2019-20074
On Netis DL4323 devices, any user role can view sensitive...
High 8.8

Affected Vendor

netis-systems

View all reports →

Affected Software

wf2411 firmware, wf2880 firmware
Vulnerable Versions:
2.1.36123

Timeline

Official Publish: February 21st, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.