CVE-2024-25139

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25139
In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/microsoft/Microsoft-TP-Link-Research-Team Third Party Advisory
https://www.tp-link.com/us/omada-sdn/ Product
https://github.com/microsoft/Microsoft-TP-Link-Research-Team Third Party Advisory
https://www.tp-link.com/us/omada-sdn/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tp-link:omada_er605_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:omada_er605:2.6:*:*:*:*:*:*:*
History

18 Sep 2025, 16:30

Type Values Removed Values Added
First Time Tp-link omada Er605 Firmware
Tp-link
Tp-link omada Er605
References () https://github.com/microsoft/Microsoft-TP-Link-Research-Team - () https://github.com/microsoft/Microsoft-TP-Link-Research-Team - Third Party Advisory
References () https://www.tp-link.com/us/omada-sdn/ - () https://www.tp-link.com/us/omada-sdn/ - Product
CPE cpe:2.3:o:tp-link:omada_er605_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:omada_er605:2.6:*:*:*:*:*:*:*

21 Nov 2024, 09:00

Type Values Removed Values Added
References () https://github.com/microsoft/Microsoft-TP-Link-Research-Team - () https://github.com/microsoft/Microsoft-TP-Link-Research-Team -
References () https://www.tp-link.com/us/omada-sdn/ - () https://www.tp-link.com/us/omada-sdn/ -

05 Aug 2024, 14:35

Type Values Removed Values Added
CWE CWE-120
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 10.0
Summary
  • (es) En TP-Link Omada er605 1.0.1 a (v2.6) 2.2.3, un binario cloud-brd es susceptible a un desbordamiento de almacenamiento dinámico que conduce a un desbordamiento del búfer de almacenamiento dinámico. Después de la configuración del montón, un atacante puede lograr la ejecución de código en el contexto del binario cloud-brd que se ejecuta en el nivel raíz. Esto se solucionó en ER605(UN)_v2_2.2.4 Build 020240119.

14 Mar 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-14 16:15

Updated : 2025-09-18 16:30

NVD link : CVE-2024-25139

Mitre link : CVE-2024-25139

CVE.ORG link : CVE-2024-25139

JSON object : View

Products Affected

tp-link

  • omada_er605
  • omada_er605_firmware
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')