Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-41285: FAST FW300R v1.3.13 arbitrary code execution and Denial of Service

CVE-2024-41285 · published 2 years ago

Summary

A bug in FAST FW300R v1.3.13 can allow hackers to potentially take control of the system or crash it. This affects systems running the affected version of the software. Update to a fixed version to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
fastcom	fw300r_firmware	1.3.13_build_141023_rel.61347n `cpe:2.3:o:fastcom:fw300r_firmware:1.3.13_build_141023_rel.61347n:::::::*`

Original advisory text

A stack overflow in FAST FW300R v1.3.13 Build 141023 Rel.61347n allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted file path.

References

https://gist.github.com/Giles-one/834b2becd7abebc3cabea0484301d149 Third Party Advisory
https://github.com/Giles-one/FW300RouterCrack/ Exploit
https://www.fastcom.com.cn/product-8.html Product

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

CWE-120Classic Buffer Overflow

Timeline

Published26 Aug 2024

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-41285 · NVD

Track software like this

Free during beta