CVE-2024-5950 is a stack-based buffer overflow in the way Deep Sea Electronics DSE855 devices handle multipart form variables, scored 8.8 (High). It needs no login and an adjacent network position. ZDI says the vendor did not patch it, so network controls are the defense.
What's affected
This is a twin of CVE-2024-5948 in the same device, but in a different code path. The record says the flaw is in handling multipart form variables, where the length of user data is not checked before it is copied into a fixed-length stack buffer. The weaknesses are CWE-121 and CWE-787. The record lists DSE855 firmware 1.1.0.
ZDI-24-674 covers this one (ZDI-CAN-23172). Its vendor response section describes the same non-answer as the other DSE855 advisory: the vendor asked why ZDI tested its products, and ZDI treated the issue as unpatched. No fixed version is named. The only mitigation offered is to restrict interaction with the application.
Severity in the record is 8.8 High and I found no other score.
How to check if you're exposed
Treat the two DSE855 issues together. Confirm the module model and firmware 1.1.0 from the device status page or your asset records.
Test reachability. From a host on the same segment, see whether the device web interface answers at all. If it does, list every device that shares that segment. If it answers from outside the segment, find out why.
What to do now
- Find all DSE855 modules and note the firmware.
- Move them to a management VLAN reachable only from named admin hosts.
- Block web interface access from user networks, guest Wi-Fi and the internet.
- Contact the vendor for a firmware update and ask directly about both CVE-2024-5948 and CVE-2024-5950.
- Plan to replace the module if no fix comes, since two overflows in one web interface suggest more may exist.
Why it matters
Two reports in the same web service, one for the boundary and one for the values, point to one root cause: the code that parses uploads does not check lengths. Fixing one parsing path would not fix the other, which is why the advisories were issued separately.
For operators, the useful lesson is how little a device like this should be trusted. If vendors do not patch, the network must carry the full burden of protection.
Quick check
How does this differ from CVE-2024-5948?
That one is in the multipart boundary. This one is in the form variable values. Same device and same class of bug.
Is any vendor patch known?
Not from the sources I read. ZDI considered it unpatched.
Sources
- ZDI-24-674
- ZDI-24-672 (sibling advisory)
- NVD record for CVE-2024-5950
Last reviewed: 19 October 2026.
