CVE-2026-2017: IP-COM W30AP Stack-Based Buffer Overflow in /goform/wx3auth
CVE-2026-2017 affects IP-COM W30AP firmware up to 1.0.0.11(1340). According to the record, a remote attacker can trigger a stack-based buffer overflow through the data argument handled by /goform/wx3auth. The CNA rates it critical with a CVSS 3.1 score of 9.8 and reports a public exploit, but the CVE is not listed in CISA KEV and the vendor did not respond to the disclosure.
Overview
CVE-2026-2017 is a memory-safety flaw in the POST request handling of the IP-COM W30AP. The record places it in the function R7WebsSecurityHandler, reached through /goform/wx3auth. It is classified as an out-of-bounds write (CWE-787) caused by a stack-based buffer overflow when the data argument is manipulated.
Impact
- The CVSS 3.1 vector supplied by the CNA indicates a network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- Memory corruption in embedded firmware can lead to crashes or code execution. The sources consulted do not state the concrete outcome for this flaw.
Affected products and versions
- Product listed: Ip-com W30ap Firmware.
- Versions: up to and including 1.0.0.11(1340), according to the record.
- No fixed version is listed in the sources consulted. This does not confirm that no fix exists.
Exploitation status
- The record states that the exploit is public and may be used.
- CISA KEV does not list this CVE. No active exploitation is confirmed in the sources consulted.
- The record states that the vendor was contacted early but did not respond.
Remediation and mitigation
- Inventory all W30AP devices and compare their firmware versions with the affected range.
- Since no vendor fix is listed, prioritize compensating controls: limit access to the device web and management interfaces to trusted administrative networks, remove direct internet exposure, and segment the device from sensitive systems.
- Monitor vendor channels for updates and plan replacement of devices that cannot receive a supported fix.
Detection guidance
- Review device or proxy logs for unusual POST requests to /goform/wx3auth, especially with abnormally large or malformed data values.
- Watch for unexpected reboots or service crashes on the device, which may indicate memory corruption attempts.
- Monitor traffic toward the management interface from untrusted sources.
Limitations of the available information
- The sources do not provide a fixed version, a vendor advisory, or evidence of exploitation in the wild.
- CVSS 4.0 (8.9) and CVSS 2.0 (10) scores are also listed by the CNA. The record does not explain how they relate to the 3.1 score.
- The record does not state whether the flaw is reachable under default configurations or the exact impact of exploitation.
Frequently asked questions
What is CVE-2026-2017?
It is a stack-based buffer overflow in the IP-COM W30AP firmware, triggered through the data argument handled by /goform/wx3auth. The record rates it critical with a CVSS 3.1 score of 9.8.
Which versions are affected?
The record lists IP-COM W30AP firmware up to and including 1.0.0.11(1340). No fixed version is listed in the sources consulted.
Is this vulnerability being actively exploited?
The record says a public exploit exists, but the CVE is not listed in CISA KEV, so no active exploitation is confirmed in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.