1 matches found
PT-2026-117595
Prior to 4.7.2, the unauthenticated rigctld send raw command on TCP port 4532 reaches rigctl send raw in tests/rigctl parse.c, which writes a NUL byte at bufbuf len + 1 outside its 200-byte stack buffer, and rig send raw in src/rig.c, which copies reply len - 1 bytes instead of the actual nbytes...
5.9AI score
SaveExploits0References3
20