CVE-2023-41251 is a high severity (CVSS 7.2) stack-based buffer overflow in the boa web server of the Realtek rtl819x Jungle SDK 3.4.11, reached through the formRoute function. Crafted HTTP requests can lead to code execution. The record names no fixed version, so ask your device vendor for firmware.
What's affected
The NVD record names the Realtek rtl819x Jungle Software Development Kit 3.4.11 and one product built on it: the Level1 WBR-6013 router with firmware RER4_A_v3411b_2T2R_LEV_09_170623. Other devices built on the same SDK may share the code, but the record does not list them.
The record gives no fixed version, and the Cisco Talos report it links (TALOS-2023-1894) blocked our automated request, so we could not read the vendor timeline. If you run a device on this SDK, ask the manufacturer whether a patched firmware exists.
The record scores the flaw 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness classes are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
This is embedded firmware, so there is no package manager to query. Sign in to the router or access point admin page and read the firmware version. Compare it with the one named above and with what the manufacturer lists.
If you cannot tell which SDK a device uses, check the manufacturer documentation or ask its support. Also find out whether the admin web interface is reachable from the internet or from guest networks.
What to do now
- List devices that use Realtek rtl819x based firmware, starting with the Level1 WBR-6013.
- Ask the manufacturer for a patched firmware and apply it when one exists.
- Make the admin web interface unreachable from untrusted networks, and from the internet.
- Use a strong, unique admin password, since the vector shows high privileges are needed.
- If the device is end of life with no fix, plan to replace it.
Why it matters
The weaknesses are CWE-121, a stack-based buffer overflow, and CWE-787, an out-of-bounds write. A request handler copies input into a fixed size stack buffer without enough length checking, so the write runs past the end and can overwrite control data. The vector shows an admin level account is needed, which is why the score is 7.2 and not higher.
Embedded web servers are written once and shipped in many products. A flaw in an SDK reaches every brand that built on it, and patches depend on each vendor. That is the main supply chain lesson here.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
The record does not name a fixed version. Contact the device manufacturer and watch their advisories.
Does the attacker need to log in?
The vector shows high privileges are required, so an administrator account is needed for the attack path in the record.
Sources
- Talos report TALOS-2023-1894 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41251 on Gold
Last reviewed: 19 October 2026.
