Vulnerability record · CVE-2015-2797 · published 19 June 2015
CVE-2015-2797: AirTies Air DSL modem login CGI stack buffer overflow
Airties · Air Firmware
AirTies Air series DSL modems running firmware 1.0.2.0 and earlier contain a stack-based buffer overflow in the cgi-bin/login handler, triggered by an overly long string in the redirect parameter. Because the endpoint is reachable over the network without credentials, a remote attacker can corrupt the stack and potentially execute arbitrary code on the device.
Description
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10, public exploit code, and a very high EPSS probability make this an urgent exposure for any internet-reachable AirTies Air modem.
What it is
AirTies Air series DSL modems running firmware 1.0.2.0 and earlier contain a stack-based buffer overflow in the cgi-bin/login handler, triggered by an overly long string in the redirect parameter. Because the endpoint is reachable over the network without credentials, a remote attacker can corrupt the stack and potentially execute arbitrary code on the device.
Impact
An unauthenticated remote attacker can execute arbitrary code on the modem, gaining full control of the device (CVSS 2.0 base score 10, complete confidentiality, integrity and availability impact). This can enable traffic interception, persistent firmware-level access, and use of the device as a pivot into the local network.
Attack surface
Reached over the network via HTTP requests to cgi-bin/login on the modem's web management interface; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Public exploit code exists (Exploit-DB entries 36577 and 37170 and a vendor-adjacent blog post are tagged Exploit), and EPSS is 0.77839 (99.5th percentile), though the CVE is not listed in CISA KEV.
What to do
- Apply the latest AirTies firmware for the affected Air series models; if no fixed firmware is available, replace or retire the device.
- Disable remote/WAN access to the modem web management interface and restrict cgi-bin/login to trusted management networks only.
- Place the modem behind a firewall or router that blocks inbound HTTP to its management interface from untrusted networks.
- Isolate affected modems on a segmented network so a compromised device cannot reach other internal hosts.
- Monitor vendor advisories for an updated firmware release covering firmware 1.0.2.0 and earlier.
Detection
- Inspect HTTP request logs or IDS/IPS alerts for unusually long redirect parameter values sent to cgi-bin/login.
- Alert on inbound HTTP requests to the modem management interface originating from external or unexpected source addresses.
- Monitor modem behavior for unexpected outbound connections, reboots, or configuration changes that could indicate compromise.
- Use network traffic analysis to detect exploit payload patterns targeting the login CGI endpoint.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-2797 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-2797), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
