CVE-2021-38278

Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function

published March 23, 2022

CVSS
—
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

⚠️ A sneaky buffer overflow can sneak right in through the `urls` parameter! This occurs in the `saveParentControlInfo` function of Tenda AC10-1200 v15.03.06.23_EN. Think of it like a restaurant where the chef accidentally overfills a pot, causing the contents to spill over and contaminate the kitchen. In this case, the buffer overflow allows unexpected inputs to overflow and potentially disrupt the system. An attacker could exploit this vulnerability to crash the router or, in a worst-case scenario, gain unauthorized access to sensitive settings. While there's no immediate critical threat discovered yet, it's a recipe for potential chaos down the line!

Put simply

Think of it like a restaurant where the chef accidentally overfills a pot, causing the contents to spill over and contaminate the kitchen. In this case, the buffer overflow allows unexpected inputs to overflow and potentially disrupt the system. The buffer overflow occurs due to the improper handling of input in the `urls` parameter, which can lead to memory corruption when processing requests in the `saveParentControlInfo` function.

What to do

An attacker could exploit this vulnerability to crash the router or, in a worst-case scenario, gain unauthorized access to sensitive settings. While there's no immediate critical threat discovered yet, it's a recipe for potential chaos down the line! Ensure you update your router firmware to the latest version that addresses this issue. Consider changing the default settings to limit exposure and regularly review your device's security configurations. You've got this! By staying proactive, you can keep your network secure and your router running smoothly. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01408 · 72.4th percentile
Published
2022-03-23T18:57Z
EPSS history
Timeline
  • 23 MAR 18:57Z
    Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function
    cvelistv5