EHG2408 series switches contain a stack-based buffer overflow that an attacker can trigger without authentication. The flaw allows control over the program’s execution flow, giving the attacker the ability to execute arbitrary code. The vulnerability corresponds to patterns documented in CWE‑121 and CWE‑787, and its exploitation would compromise confidentiality, integrity, and availability of the affected device.

The affected devices are Atop Technologies’ EHG2408 and EHG2408‑2SFP switches. Firmware versions older than 3.36 are vulnerable; all devices running firmware prior to this release are impacted. Firmware updates to 3.36 or later patch the flaw.

The CVSS score of 9.3 classifies this as Critical, although the EPSS score is less than 1 %, indicating a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Attackers would reach the switch over the network with no authentication, submit a crafted packet or command to overflow the buffer, and gain remote code execution. No additional conditions or privileges are required beyond network connectivity.