CVE-2024-7441
moderate-risk
Published 2024-08-03
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This vulnerability affects the function read of the component httpd. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273526 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
Do I need to act?
~
7.3% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Products (1)
Sd9364 Firmware
Affected Vendors
References (4)
Permissions Required
https://vuldb.com/?ctiid.273526
Permissions Required
https://vuldb.com/?id.273526
Third Party Advisory
https://vuldb.com/?submit.383842
Permissions Required
https://yjz233.notion.site/vivotek-SD9364-has-stack-buffer-overflow-vulnerabilit...
45
/ 100
moderate-risk
Severity
30/34 · Critical
Exploitability
10/34 · Low
Exposure
5/34 · Minimal