Published: 01/08/2022 Updated: 02/09/2022
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an malicious user to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

realtek ecos_rsdk_firmware 1.5.7p1

realtek ecos_msdk_firmware 4.9.4p1

Github Repositories

CVE-2022-27255-checker Simple checker for CVE-2022-27255 using poc_crash and telnet availability Code is simplified and using minimal external libs Usage: checkerpy Original: githubcom/infobyte/cve-2022-27255/blob/main/exploits_nexxt/poc_crashpy

CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow Este repositório contém os materiais para a palestra "Exploring the hidden attack surface of OEM IoT devices: pwning milhares de roteadores com uma vulnerabilidade no SDK da Realtek para eCos OS", que foi apresentada em DEFCON30 O conteúdo deste repositório inclui: analysis: Autom