CVE-2023-24613

CVSS V2 None CVSS V3 None

Description

The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function call stack after accessing the system with administrator privileges. A successful exploit could leverage this vulnerability in the backend binary file that handles the user interface to a cause denial of service attack. This is fixed in AG 9.4.0.481.

Overview

CVE ID
CVE-2023-24613

Assigner
cve@mitre.org

Vulnerability Status
Analyzed

Published Version
2023-02-03T02:15:07

Last Modified Date
2023-02-10T16:14:30

Weakness Enumerations

CWE	URL
CWE-787	http://cwe.mitre.org/data/definitions/787.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
		AND
cpe:2.3:o:arraynetworks:arrayos_ag::::::::	1	OR	9.4.0.470
cpe:2.3:h:arraynetworks:ag1000:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1000t:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1000v5:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1100v5:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1150:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1200:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1200v5:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1500:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1500fips:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1500v5:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1600:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:ag1600v5:-:::::::*	0	OR
cpe:2.3:h:arraynetworks:vxag:-:::::::*	0	OR

References

Reference URL	Reference Tags
https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_UI_Stack_Overflow_Vulnerability_ID-128285_V1.0.pdf	Vendor Advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-24613
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24613

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 07:08:36				Added to TrackCVE
2023-04-17 07:08:39			Weakness Enumeration	new