VulnSocial

CVE-2024-6146Active Exploitation(actiontec / wcb6200q)

LOWCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for actiontec wcb6200q systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP server. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HTTP server. Was ZDI-CAN-21418.

actiontec CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-121CWE-787

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • wcb6200q
  • wcb6200q_firmware

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
actiontec
Products
wcb6200qwcb6200q_firmware

2 versions affected across 2 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-09: 1Active Exploitation · 2026-09-09: 109-09
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting CVE-2024-6146 to compromise N-able N-central servers, then leveraging MSP infrastructure for lateral movement across entire customer environments. Runtime segmentation limits blast radius when management infrastructure is compromised. #SupplyChainSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/n-able-n-central-pre-auth-rce-cve-2026-86218-exploited-wild

    Post summary

    Report indicates attackers are actively exploiting CVE‑2024‑6146 against N‑Able N‑Central servers, using attacker‑compromised MSP infrastructure for lateral movement across client environments.

    0000050
    2.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
HWactiontecwcb6200q---
OSactiontecwcb6200q_firmware1.2l.03.5--

Explore more

Back to dashboardactiontec CVEswcb6200q vulnerabilities