CVE-2018-8072: edimax ic-3140w_firmware Out-of-bounds Write
Vulnerability summary
CVE-2018-8072 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in edimax ic-3140w_firmware. EPSS estimates a 2.75% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 26-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered on EDIMAX IC-3140W through 3.06, IC-5150W through 3.09, and IC-6220DC through 3.06 devices. The ipcam_cgi binary contains a stack-based buffer overflow that is possible to trigger from a remote unauthenticated /camera-cgi/public/getsysyeminfo.cgi?action=VALUE_HERE HTTP request: if the VALUE_HERE length is more than 0x400 (1024), it is possible to overwrite other values located on the stack due to an incorrect use of the strcpy() function.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.75%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
+0.78 pp
From 1.96% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (gitlab.com)
Maturity: unknown
Exploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Edimax3 products
- ic-3140w_firmware≤ 3.06
- ic-5150w_firmware≤ 3.09
- ic-6220dc_firmware≤ 3.06
1 vendor · 3 products
References
4 links- gitlab.com/nemux/CVE-2018-8072/blob/master/nemux_codemotion_Rome18_cover.pdfX Refsource MISCExploitTechnical DescriptionThird Party Advisory
- gitlab.com/nemux/CVE-2018-8072/blob/master/CVE-2018-8072_PoC.txtX Refsource MISCExploitThird Party Advisory