CVE-2024-3120Disclosure(irontec / sngrep)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch irontec sngrep systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A stack-buffer overflow vulnerability exists in all versions of sngrep since v1.4.1. The flaw is due to inadequate bounds checking when copying 'Content-Length' and 'Warning' headers into fixed-size buffers in the sip_validate_packet and sip_parse_extra_headers functions within src/sip.c. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via crafted SIP messages.

irontec CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-120CWE-787

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sngrep

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

irontec

Products

sngrep

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2024-3120/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
CVE-2024-3120 - Critical buffer overflow in Sngrep (v1.4.1+). RCE/DoS via crafted SIP messages. CVSS 9.0. No patch available. Disable or restrict access immediately. #CVE #infosec #cybersecurity #CVEAlert #DevSecOps More info and test LAB: https://www.valtersit.com/cve/CVE-2024-3120/
Post summary
The post announces CVE-2024-3120, a critical buffer overflow in Sngrep enabling RCE/DoS via crafted SIP messages (CVSS 9.0), notes that no patch exists and advises disabling or restricting access, and provides a link to a test lab.
0000038
919 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	irontec	sngrep	-	-	-

Explore more

Back to dashboard irontec CVEs sngrep vulnerabilities