Ntc2218, Ntc2250, Ntc2299
Approved changes feed: RSS · Atom
cpe:2.3:a:newtec/idirect:ntc2218,_ntc2250,_ntc2299:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Newtec/Idirect (696d07aa-b549-5857-ac97-8cd2a2f13bb7) |
|---|---|
| Product | Ntc2218, Ntc2250, Ntc2299 (f153405c-3242-56aa-9f0d-dcdbae89035f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-13503 |
vulnerable | 2026-06-08 06:25:37.827505 |
Stack-Based Buffer Overflow in Newtec's update signaling causes RCE
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Newtec NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM (Updating signaling process in the swdownload binary modules) allows Local Execution of Code, Remote Code Inclusion.
This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19. The issue is both present on the PowerPC versions of the modem and the ARM versions.
A stack buffer buffer overflow in the swdownload binary allows attackers to execute arbitrary code. The parse_INFO function uses an unrestricted `sscanf` to read a string of an incoming network packet into a statically sized buffer.
Published: 2025-01-17T13:52:35.803Z
Updated: 2025-01-17T16:01:06.569Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13502 |
vulnerable | 2026-06-08 06:25:37.827083 |
A command injection in the NTC2218, NTC2250, NTC2299 modems' web interfaces allows to exeucte arbitrary shell commands.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Newtec/iDirect NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM allows Local Code Inclusion.This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19.
The `commit_multicast` page used to configure multicasts in the modem's web administration interface uses improperly parses incoming data from the request before passing it to an `eval` statement in a bash script. This allows attackers to inject arbitrary shell commands.
Published: 2025-01-17T14:01:03.084Z
Updated: 2025-01-17T14:49:20.740Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.