Buffer overflow in Viasat Eg1000
CVE-2024-6198
The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. This interface is affected by a stack buffer overflow vulnerability due to insecure path parsing. An attacker with access to the LAN network interface could use a specially crafted HTTP request to exploit a buffer overflow on the modem.
Vulnerability class: Buffer Overflow
EPSS: 0.003 (20.2th percentile) — read the EPSS interpretation.
Affected products
- Viasat Eg1000 — versions 0
- Viasat Eg1020 — versions 0
- Viasat Em4100 — versions 0
- Viasat Rg1000 — versions 0
- Viasat Rg1100 — versions 0
- Viasat Rm4100 — versions 0
- Viasat Rm4200 — versions 0
- Viasat Rm5110 — versions 0
- Viasat Rm5111 — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- research@onekey.com (technical-description, third-party-advisory)
Frequently asked questions
- What is CVE-2024-6198?
- CVE-2024-6198 is a vulnerability in Viasat Eg1000, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). Published 2025-04-25.
- Is CVE-2024-6198 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.