Opengear
Monthly
Heap-based buffer overflow in Opengear console server firmware 4.8.0 through 5.5.2 (IM72XX, CM71XX and ACM70XX appliances) lets an unauthenticated remote attacker crash the index.cgi process by sending a multipart/form-data POST request whose Content-Disposition name field is overlong. The CVSS 4.0 score of 8.4 reflects a network-reachable, no-authentication, no-interaction attack path, but it is tempered by AC:H and AT:P - a specific attack condition outside the attacker's direct control and high complexity - so a crash is readily achievable while anything beyond denial of service is constrained. The confirmed impact described by the vendor is the index.cgi crash; the vendor advisory reference is titled as buffer overflow to RCE, so remote code execution is vendor-claimed rather than independently demonstrated. No public exploit code or PoC is confirmed in the supplied intelligence, and the issue is not reported as actively exploited (CISA KEV); the vuln.today decision label is 'this_week', so firmware 5.5.3 should be scheduled promptly for internet-facing appliances.
Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in Opengear console server firmware 4.8.0 through 5.5.2 (IM72XX, CM71XX and ACM70XX appliances) lets an unauthenticated remote attacker crash the index.cgi process by sending a multipart/form-data POST request whose Content-Disposition name field is overlong. The CVSS 4.0 score of 8.4 reflects a network-reachable, no-authentication, no-interaction attack path, but it is tempered by AC:H and AT:P - a specific attack condition outside the attacker's direct control and high complexity - so a crash is readily achievable while anything beyond denial of service is constrained. The confirmed impact described by the vendor is the index.cgi crash; the vendor advisory reference is titled as buffer overflow to RCE, so remote code execution is vendor-claimed rather than independently demonstrated. No public exploit code or PoC is confirmed in the supplied intelligence, and the issue is not reported as actively exploited (CISA KEV); the vuln.today decision label is 'this_week', so firmware 5.5.3 should be scheduled promptly for internet-facing appliances.
Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.