CVE-2024-2169 Implementations of UDP application protocols are susceptible to network loops and denial of service

2024-03-1919:50:10

certcc

github.com

udp application protocols

vulnerable

network loops

denial of service

dos

unauthenticated attacker

maliciously-crafted packets

abuse of resources

AI Score

7.2

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.

CNA Affected

[
  {
    "vendor": "MikroTik",
    "product": "RouterOS-TFTP",
    "versions": [
      {
        "status": "affected",
        "version": "*",
        "versionType": "custom",
        "lessThanOrEqual": "7.13.2"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "WDS",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ]
  },
  {
    "vendor": "dproxy-nexgen",
    "product": "dproxy-nexgen",
    "versions": [
      {
        "status": "affected",
        "version": "0.1",
        "versionType": "custom",
        "lessThanOrEqual": "0.5"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mikrotik:routeros_tftp:*:*:*:*:*:*:*:*"
    ],
    "vendor": "mikrotik",
    "product": "routeros_tftp",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "7.13.2"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:microsoft:wds:*:*:*:*:*:*:*:*"
    ],
    "vendor": "microsoft",
    "product": "wds",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "*"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:dproxy-nexgen_project:dproxy-nexgen:-:*:*:*:*:*:*:*"
    ],
    "vendor": "dproxy-nexgen_project",
    "product": "dproxy-nexgen",
    "versions": [
      {
        "status": "affected",
        "version": "0.1",
        "versionType": "custom",
        "lessThanOrEqual": "0.5"
      }
    ],
    "defaultStatus": "unknown"
  }
]