CVE-2024-6198: Lighttpd SNORE Buffer Overflow Vulnerability

CVE-2024-6198 is a stack buffer overflow flaw in lighttpd's SNORE interface affecting web services on TCP ports 3030 and 9882. Attackers on the LAN can exploit this with crafted HTTP requests to trigger buffer overflow conditions. This post explains its impact, affected versions, and mitigation steps.

CVE-2024-6198 Overview

CVE-2024-6198 is a stack buffer overflow vulnerability in the SNORE web interface exposed by Viasat modems on TCP ports 3030 and 9882. The affected web service runs lighttpd and parses request paths insecurely. An attacker with access to the LAN network interface can send a specially crafted HTTP request to overflow a stack buffer on the modem. Successful exploitation can lead to remote code execution on the device. The vulnerability is tracked under CWE-120 (Classic Buffer Overflow) and was disclosed in a OneKey Security Advisory on CVE-2024-6198.

Critical Impact
An adjacent-network attacker can achieve arbitrary code execution on affected Viasat modems by sending a crafted HTTP request to the SNORE interface.

Affected Products

Viasat modems exposing the SNORE web interface on TCP/3030 and TCP/9882
lighttpd-based web service implementing the SNORE interface on the affected modems
Specific firmware versions are enumerated in the OneKey Security Advisory on CVE-2024-6198

Discovery Timeline

2025-04-25 - CVE-2024-6198 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6198

Vulnerability Analysis

The affected modems expose a lighttpd-based web service on TCP/3030 and TCP/9882. This service implements a proprietary SNORE interface used for device management functionality. The interface performs path parsing on incoming HTTP requests without adequate bounds checking. A crafted request path can therefore write past the end of a fixed-size stack buffer.

Because the overflow occurs on the stack, an attacker can overwrite the saved return address and redirect execution. This yields arbitrary code execution in the context of the web service process on the modem. The attacker must be on the same LAN segment as the modem, which limits remote reachability but does not require authentication or user interaction.

The issue is classified as CWE-120, a classic buffer copy without checking size of input. Compromise of the modem allows attackers to intercept traffic, pivot into the local network, and persist on the device.

Root Cause

The SNORE handler inside the lighttpd service parses HTTP request paths into a fixed-size stack buffer without validating the input length. Insecure path parsing routines copy attacker-controlled data beyond the buffer boundary, corrupting adjacent stack frames.

Attack Vector

The attack vector is Adjacent Network (AV:A). An attacker connected to the LAN interface of the modem sends an HTTP request containing an oversized or malformed path to TCP/3030 or TCP/9882. No credentials are required. See the OneKey Security Advisory on CVE-2024-6198 for technical details of the crafted request structure.

No verified public exploit code is available. A working exploit would craft an HTTP request whose path segment exceeds the vulnerable buffer size and overwrites the return address with an attacker-controlled value.

Detection Methods for CVE-2024-6198

Indicators of Compromise

Unexpected HTTP requests to TCP/3030 or TCP/9882 on the modem LAN interface, particularly with abnormally long URI paths
Unusual outbound connections from the modem to unknown hosts, indicating post-exploitation activity
Modem service restarts or crashes in lighttpd logs correlated with malformed HTTP traffic

Detection Strategies

Deploy network monitoring on LAN segments containing Viasat modems to alert on HTTP requests with URI lengths exceeding normal management traffic
Inspect HTTP traffic destined for TCP/3030 and TCP/9882 for non-standard path characters and oversized components
Correlate modem reboot events with preceding HTTP traffic patterns to identify exploitation attempts

Monitoring Recommendations

Restrict management access to the modem web interface to a dedicated administrative VLAN and log all connection attempts
Ingest network flow and packet capture data from modem-adjacent segments into a centralized analytics platform for retrospective hunting
Alert on any device on the LAN scanning TCP/3030 or TCP/9882, as this may indicate reconnaissance before exploitation

How to Mitigate CVE-2024-6198

Immediate Actions Required

Apply firmware updates from Viasat as soon as they are made available for the affected modem models
Restrict LAN access to the modem management ports TCP/3030 and TCP/9882 using upstream network segmentation and ACLs
Inventory all Viasat modems in the environment and validate their firmware versions against vendor advisories

Patch Information

Refer to the OneKey Security Advisory on CVE-2024-6198 for the list of affected firmware versions and any coordinated vendor fix status. No specific patch identifier is available in the enriched CVE data. Contact Viasat directly for firmware distribution guidance.

Workarounds

Place affected modems behind a firewall that blocks LAN-side access to TCP/3030 and TCP/9882 from untrusted hosts
Isolate modems on a dedicated management network with only authorized administrative workstations permitted to reach the web interface
Disable the SNORE web interface if the device configuration allows it and the functionality is not required for operations

bash

# Example: block access to the SNORE ports from untrusted LAN clients using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <modem_ip> --dport 3030 -j DROP
iptables -A FORWARD -p tcp -d <modem_ip> --dport 9882 -j DROP