« Volver al listado

CVE-2024-6199

Estado: AplazadaAlta (7.7)—

An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the modem, could manipulate specific responses to include code that forces a buffer overflow on the modem.

Customers that have not enabled Dynamic DNS on their modem are not vulnerable.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A (red adyacente) + CWE-120 (buffer overflow) + manipulación de tráfico DDNS → explotación de servicio remoto (T1210). Buffer overflow en modem ejecuta código arbitrario (T1059) y potencialmente escala privilegios (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6199",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6199",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-25T14:25:03.626698Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "research@onekey.com",
        "cvssData": {
          "Safety": "NEGLIGIBLE",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 7.7,
          "Automatable": "NO",
          "attackVector": "ADJACENT",
          "baseSeverity": "HIGH",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Red",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "RED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "research@onekey.com",
      "affectedData": [
        {
          "vendor": "ViaSat",
          "modules": [
            "DDNS"
          ],
          "product": "RM5110",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.3.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ViaSat",
          "modules": [
            "DDNS"
          ],
          "product": "RM5111",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.3.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Viasat",
          "modules": [
            "DDNS"
          ],
          "product": "RG1100",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.3.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Viasat",
          "product": "EG1000",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.3.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Viasat",
          "product": "EG1020",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.3.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-25T13:15:43.510",
  "references": [
    {
      "url": "https://www.onekey.com/resource/security-advisory-rce-on-viasat-modems-cve-2024-6199",
      "source": "research@onekey.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "research@onekey.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the modem, could manipulate specific responses to include code that forces a buffer overflow on the modem.\n\nCustomers that have not enabled Dynamic DNS on their modem are not vulnerable."
    },
    {
      "lang": "es",
      "value": "Un atacante no autenticado en la interfaz WAN, capaz de interceptar el tráfico de DNS dinámico (DDNS) entre los servicios DDNS y el módem, podría manipular respuestas específicas para incluir código que provoque un desbordamiento de búfer en el módem. Los clientes que no tienen habilitado el DNS dinámico en su módem no son vulnerables."
    }
  ],
  "lastModified": "2026-06-17T08:17:29.793",
  "sourceIdentifier": "research@onekey.com"
}