CVE-2019-8985

🗓️ 21 Feb 2019 19:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 73 Views🌐 WEB

Netis WF2411 and other WF2xxx devices firmware 2.1.36123 and earlier allow unauthenticated stack-based buffer overflow, leading to denial of service or remote code execution via mishandled "Authorization: Basic" HTTP header in /bin/boa

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2019-8985	21 Feb 201919:00	–	cvelist
Kitploit	CVE-2019-8985	9 Oct 202602:04	–	kitploit
NVD	CVE-2019-8985	21 Feb 201919:29	–	nvd
OSV	CVE-2019-8985	21 Feb 201919:29	–	osv
Prion	Stack overflow	21 Feb 201919:29	–	prion
Positive Technologies	PT-2019-19288	21 Feb 201900:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2019-8985: Missing Authentication for Critical Function	21 Feb 201900:00	–	rapid7

NVD

Node

AND

netis-systems wf2411_firmwareMatch2.1.36123

netis-systems wf2411Match-

Node

AND

netis-systems wf2880_firmwareMatch2.1.36123

netis-systems wf2880Match-

Source	Link
github	www.github.com/WhooAmii/whooamii.github.io/blob/master/2018/netis/buffer%20overflow.md

Parameter	Position	Path	Description	CWE
Authorization	header	/bin/boa	Stack-based buffer overflow in Boa web server triggered by a long Authorization header in a GET request; unauthenticated, leading to denial of service or remote code execution.	CWE-306, CWE-787

17 Jun 2026 02:42Current

9.8Critical risk

Vulners AI Score9.8

CVSS 29

CVSS 39.8

EPSS0.13296

CWE-306 CWE-787

netis wf2411 wf2xxx firmware buffer overflow denial of service remote code execution http security vulnerability