Vulnerability record · CVE-2007-4915 · published 17 September 2007
CVE-2007-4915: Boa isl3893 stack write flaw lets remote attackers overwrite admin password
Boa · Boa Webserver
The Intersil isl3893 extensions for Boa 0.93.15 fail to prevent stack writes from landing in memory used for string constants. A remote attacker can therefore alter the admin password held in memory by sending a long username in an HTTP Basic Authentication request. This affects the FreeLan RO80211G-AP and other devices using this Boa build.
Description
The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent stack writes from entering memory locations used for string constants, which allows remote attackers to change the admin password stored in memory via a long username in an HTTP Basic Authentication request.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote code/data manipulation with CVSS 10.0, public exploit code, and very high EPSS makes this an urgent risk for exposed devices.
What it is
The Intersil isl3893 extensions for Boa 0.93.15 fail to prevent stack writes from landing in memory used for string constants. A remote attacker can therefore alter the admin password held in memory by sending a long username in an HTTP Basic Authentication request. This affects the FreeLan RO80211G-AP and other devices using this Boa build.
Impact
An unauthenticated remote attacker can change the device admin password in memory, gaining administrative control of the affected device. This can lead to full compromise of the device and any network it manages.
Attack surface
Reachable over the network via HTTP Basic Authentication; no authentication is required because the flaw is triggered by the username field before credentials are validated. No user interaction is needed.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.68, 99th percentile) and a public Exploit-DB entry (4542) exists, indicating exploit code is available.
What to do
- Patch or replace the affected Boa/isl3893 firmware on FreeLan RO80211G-AP and similar devices as soon as a vendor fix is available.
- If no patch exists, disable or restrict HTTP Basic Authentication on the management interface and block external access to the web server.
- Segment or isolate affected devices on a dedicated management VLAN with strict firewall rules.
- Monitor vendor advisories for updated firmware and retire unsupported devices.
Detection
- Inspect HTTP request logs for unusually long usernames in Basic Authentication headers.
- Alert on unexpected admin password changes or authentication failures followed by successful logins.
- Monitor for known exploit traffic or scanning against the Boa web interface.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-4915 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-4915), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
