Buffer overflow in Viasat Eg1000
CVE-2024-6198
The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. This interface is affected by a stack buffer overflow vulnerability due to insecure path parsing. An attacker with access to the LAN network interface could use a specially crafted HTTP request to exploit a buffer overflow on the modem.
Vulnerability class: Buffer Overflow
Published · last modified .
EPSS exploit prediction
EPSS: 0.003 (19.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 19.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Viasat Eg1000 — versions 0
- Viasat Eg1020 — versions 0
- Viasat Em4100 — versions 0
- Viasat Rg1000 — versions 0
- Viasat Rg1100 — versions 0
- Viasat Rm4100 — versions 0
- Viasat Rm4200 — versions 0
- Viasat Rm5110 — versions 0
- Viasat Rm5111 — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.onekey.com/resource/security-advisory-rce-on-viasat-modems-cve-2024-6198 (technical-description, third-party-advisory)
Frequently asked questions
- What is CVE-2024-6198?
- CVE-2024-6198 is a vulnerability in Viasat Eg1000, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). Published 2025-04-25.
- Is CVE-2024-6198 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.