CVE-2018-3938

high-risk
Published 2018-08-14

An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST request to trigger this vulnerability.

Do I need to act?

~
2.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (14)

Snc-Eb600 Firmware
Snc-Eb630 Firmware
Snc-Eb600B Firmware
Snc-Eb630B Firmware
Snc-Eb602R Firmware
Snc-Eb632R Firmware
Snc-Em600 Firmware
Snc-Em601 Firmware
Snc-Em630 Firmware
Snc-Em631 Firmware
Snc-Em602R Firmware
Snc-Em632R Firmware
Snc-Em602Rc Firmware
Snc-Em632Rc Firmware

Affected Vendors

Sony

References (2)

Third Party Advisory https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0605
Third Party Advisory https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0605
55
/ 100
high-risk
Severity 31/34 · Critical
Exploitability 6/34 · Minimal
Exposure 18/34 · Moderate