CVE-2023-50330 is a High severity (CVSS 7.2) stack based buffer overflow in the boa web server in Realtek rtl819x Jungle SDK 3.4.11, also listed for the Level1 WBR-6013 router. HTTP requests can lead to code execution. I could not confirm a fixed version, so limit access to the device's web interface.
What's affected
Products in the record: Realtek rtl819x Jungle Software Development Kit 3.4.11, Level1 WBR-6013 firmware version rer4_a_v3411b_2t2r_lev_09_170623, and the WBR-6013 hardware. Fixed version: not confirmed. The record's only reference is a Cisco Talos report, TALOS-2023-1903, and that page was blocked when I tried to fetch it, so I am relying on the record text. NVD published the record on 8 July 2024.
Severity: the record scores it 7.2 High with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vector requires high privileges, which suggests the attacker needs administrator access to the web interface. I have only the one score, so there is no conflict to report.
The description says a specially crafted series of HTTP requests can trigger the overflow in the getInfo functionality of the boa web server. I have not seen an advisory from the device or chip vendor that names a patched firmware, so check their support pages directly.
How to check if you're exposed
This is embedded firmware, so the check is about devices and not packages. Find any Level1 WBR-6013 routers, and any other devices built on a Realtek rtl819x SDK, which is common in low cost routers and access points.
On the device's administration page, read the firmware version and compare it with the version in the record, rer4_a_v3411b_2t2r_lev_09_170623. If it matches, treat the device as affected. If it is different but the device is built on the same SDK family, ask the manufacturer.
Also check whether the administration interface is reachable from the internet or from guest networks. Many embedded devices expose the web interface to the wrong side of the network by default.
Vendor products like this do not appear in a dependency scan, so the inventory is the control. Record each instance with its version, owner and the networks that can reach it.
What to do now
- Inventory routers and access points that use a Realtek rtl819x chipset, starting with the Level1 WBR-6013.
- Check the manufacturer's support page for newer firmware and read its notes, and update if a release addresses this issue.
- Turn off remote administration, and allow web interface access only from a trusted management host.
- Change default administrator passwords, since the vector says high privileges are needed.
- If the device is end of life and no fix exists, plan to replace it.
Why it matters
The weakness is CWE-121, a stack based buffer overflow, and the record also maps it to CWE-787, out of bounds write. The description places it in the boa web server's getInfo function. The usual cause is that a handler copies request data into a fixed size stack buffer without checking its length, so oversized input overwrites adjacent memory, including control data.
Embedded web servers like boa are small, old and widely reused, which is why one SDK flaw can show up across many brands. Updates for such devices often arrive late or never, which is the real risk in practice.
KEV is false and I found no claim of exploitation. The vector needs high privileges, which narrows exposure to attackers who already hold administrator access, but a stack overflow in an internet facing admin page is still best fixed or isolated. The Gold directory lists this CVE and its CWEs.
Quick check
Is there a patched firmware?
I could not confirm one. The record cites only a Talos report that I could not load. Check the manufacturer support page.
Why does the vector say high privileges?
The record lists PR:H, which means an attacker needs administrator level access to the web interface to reach the flaw.
Sources
Last reviewed: 19 October 2026.
