CVE-2020-15173 - CVE House
Back to Database
Status published High CVE-2020-15173

Heap buffer overflow in ACCEL-PPP

Vulnerability Description

In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15173

Credits & Attribution

No credits recorded in the NVD database.

References

More from accel-ppp

View All →
CVE-2021-42870
ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing...
High 7.5
CVE-2021-42054
ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the...
High 7.5
CVE-2020-28194
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS...
Critical 9.8

Affected Vendor

Affected Software

accel-ppp
Vulnerable Versions:
<= 1.12.0-92-g38b6104

Timeline

Official Publish: September 9th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-119

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1203 Exploitation for Client Execution
Execution
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control