CVE-2020-15173 HIGH

CVE-2020-15173: Heap buffer overflow in ACCEL-PPP

Vendor Accel-Ppp
Product accel-ppp
Weakness CWE-119
Published September 9, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.

Key dates

02Disclosure timeline

September 9, 2020 CVE published
August 4, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-3323 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability CVE-2023-21628 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL CVE-2012-6438 Rockwell Automation ControlLogix PLC Improper Input Validation CVE-2025-14407 Soda PDF Desktop PDF File Parsing Memory Corruption Information Disclosure Vulnerability CVE-2020-3288 Cisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution Vulnerabilities