CVE-2022-40986

Name of the Vulnerable Software and Affected Versions Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020

Description Several stack-based buffer overflow issues exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these issues. The buffer overflow is in the function that manages the (ddns1|ddns2) mx WORD command template.

Recommendations For version G5.0.1.5-210720-141020, as a temporary workaround, consider disabling the function that manages the (ddns1|ddns2) mx WORD command template until a patch is available. Restrict access to the DetranCLI command parsing functionality to minimize the risk of exploitation. Avoid using the (ddns1|ddns2) mx WORD command template in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.