What is the CVSS score of CVE-2014-0355?

CVE-2014-0355 has a CVSS 2.0 base score of 7.9 (High). CVSS vector: AV:A/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 0.2%.

N300 Netusb Nbg 419N Firmware CVE-2014-0355

HIGH

Buffer Overflow (CWE-119)

2014-04-15 cret@cert.org

Zyxel Buffer Overflow RCE N300 Netusb Nbg 419N Firmware N300 Netusb Nbg 419N

7.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.9 HIGH

AV:A/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:A/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Adjacent

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Apr 15, 2014 - 10:55 cve.org

HIGH 7.9

DescriptionCVE.org

Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command.

AnalysisAI

Technical ContextAI

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command. Affected products include: Zyxel N300 Netusb Nbg-419N Firmware, Zyxel N300 Netusb Nbg-419N.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.