CVE-2024-36251: The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted paramete...

Description

The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

3.52%

87.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-125

References

Timeline

Published: Nov 26, 2024
Last Modified: Jun 17, 2026
Status: Deferred

Frequently Asked Questions

What is CVE-2024-36251?

The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

How severe is CVE-2024-36251?

CVE-2024-36251 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 3.52% probability of exploitation in the next 30 days.

How do I fix CVE-2024-36251?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.