Read the docs
TI-2026-19617 Aliases CVE-2026-24344GHSA-6pg2-g9vc-4g7p

Multiple Buffer Overflows in EZCast Pro II Dongle

Priority LOW 33CWE-120Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Multiple Buffer Overflows in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to cause a program crash and potential remote code execution

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EZCastEZCast Pro II1.17478.146 and later—No fix listedCNA
  • EZCast Pro II VendorEZCast Affected 1.17478.146 and later Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:nimbletech:ezcast_pro_dongle_ii_firmware:*:*:*:*:*:*:*:*——EZCast
  • cpe:2.3:o:nimbletech:ezcast_pro_dongle_ii_firmware:*:*:*:*:*:*:*:* Versions — — ·EZCast

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24344
  2. 2026-10-03 Alias added: GHSA-6pg2-g9vc-4g7p

References

Other 1

  • TI-2025-12752 Predictable Default Wi-Fi Password in EZCast Pro II Dongle CVSS 4.0CRITICAL 9.3
  • TI-2025-12751 Hard-coded cryptographic keys in EZCast Pro II Dongle CVSS 4.0CRITICAL 9.3
  • TI-2026-19619 Use of well-known default credentials in EZCast Pro II Dongle CVSS 4.0HIGH 7.6
  • TI-2026-19621 Multiple cross-site scripting vulnerabilities in EZCast Pro II Dongle CVSS 4.0HIGH 7.4
  • TI-2026-19618 Cross-Site Request Forgery in EZCast Pro II Dongle CVSS 4.0MEDIUM 6.8
  • TI-2026-19620 Arbitrary file write to /tmp directory in EZCast Pro II Dongle CVSS 4.0MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences