Lucene search

MitreCVE-2023-35802

HistoryJul 15, 2023 - 2:15 a.m.

CVE-2023-35802

2023-07-1502:15:08

CWE-120

mitre

web.nvd.nist.gov

cve-2023-35802

iq engine

extreme network

buffer overflow

capwap protocol

remote code execution

elevated privileges

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

78.3%

JSON

IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevated privileges to conduct remote code execution. Access to the internal management interface/subnet is required to conduct the exploit.

Affected configurations

Nvd

Node

extremenetworksiq_engineRange<10.6r1

AND

extremenetworksap122Match-

extremenetworksap130Match-

extremenetworksap150wMatch-

extremenetworksap250Match-

extremenetworksap30Match-

extremenetworksap3000Match-

extremenetworksap3000xMatch-

extremenetworksap302wMatch-

extremenetworksap305cMatch-

extremenetworksap305c-1Match-

extremenetworksap305cxMatch-

extremenetworksap4000Match-

extremenetworksap4000-1Match-

extremenetworksap410cMatch-

extremenetworksap410c-1Match-

extremenetworksap460cMatch-

extremenetworksap460s12cMatch-

extremenetworksap460s6cMatch-

extremenetworksap5010Match-

extremenetworksap5050dMatch-

extremenetworksap5050uMatch-

extremenetworksap510cMatch-

extremenetworksap510cxMatch-

extremenetworksap630Match-

extremenetworksap650Match-

extremenetworksap650xMatch-

Node

extremenetworksiq_engineRange<10.6r5

AND

extremenetworksap1130Match-

extremenetworksap550Match-

VendorProductVersionCPE
extremenetworksiq_engine*cpe:2.3:o:extremenetworks:iq_engine:*:*:*:*:*:*:*:*
extremenetworksap122-cpe:2.3:h:extremenetworks:ap122:-:*:*:*:*:*:*:*
extremenetworksap130-cpe:2.3:h:extremenetworks:ap130:-:*:*:*:*:*:*:*
extremenetworksap150w-cpe:2.3:h:extremenetworks:ap150w:-:*:*:*:*:*:*:*
extremenetworksap250-cpe:2.3:h:extremenetworks:ap250:-:*:*:*:*:*:*:*
extremenetworksap30-cpe:2.3:h:extremenetworks:ap30:-:*:*:*:*:*:*:*
extremenetworksap3000-cpe:2.3:h:extremenetworks:ap3000:-:*:*:*:*:*:*:*
extremenetworksap3000x-cpe:2.3:h:extremenetworks:ap3000x:-:*:*:*:*:*:*:*
extremenetworksap302w-cpe:2.3:h:extremenetworks:ap302w:-:*:*:*:*:*:*:*
extremenetworksap305c-cpe:2.3:h:extremenetworks:ap305c:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
extremenetworks	iq_engine	*	cpe:2.3:o:extremenetworks:iq_engine::::::::
extremenetworks	ap122	-	cpe:2.3:h:extremenetworks:ap122:-:::::::*
extremenetworks	ap130	-	cpe:2.3:h:extremenetworks:ap130:-:::::::*
extremenetworks	ap150w	-	cpe:2.3:h:extremenetworks:ap150w:-:::::::*
extremenetworks	ap250	-	cpe:2.3:h:extremenetworks:ap250:-:::::::*
extremenetworks	ap30	-	cpe:2.3:h:extremenetworks:ap30:-:::::::*
extremenetworks	ap3000	-	cpe:2.3:h:extremenetworks:ap3000:-:::::::*
extremenetworks	ap3000x	-	cpe:2.3:h:extremenetworks:ap3000x:-:::::::*
extremenetworks	ap302w	-	cpe:2.3:h:extremenetworks:ap302w:-:::::::*
extremenetworks	ap305c	-	cpe:2.3:h:extremenetworks:ap305c:-:::::::*

Rows per page:

1-10 of 291

References

extremeportal.force.com/ExtrArticleDetail?an=000112741

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

78.3%

JSON

Related for CVE-2023-35802