CVE-2022-24018CWE-120

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14

Critical · published August 5, 2022

CVSS v3.0
9.6
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

🔥 A buffer overflow vulnerability lurks in TCL LinkHub Mesh Wi-Fi that could lead to disastrous consequences if left unaddressed! Think of it as a water pipe that can only hold a certain amount of water. If you try to pump in too much at once, it overflows and creates a mess everywhere — in this case, the overflow can let attackers manipulate your device’s configuration. 📦💧 An attacker could trigger this overflow by modifying configuration values, potentially leading to unauthorized access or control over the device. This could even allow them to execute arbitrary code, which is nothing short of an open invitation for chaos!

Put simply

Think of it as a water pipe that can only hold a certain amount of water. If you try to pump in too much at once, it overflows and creates a mess everywhere — in this case, the overflow can let attackers manipulate your device’s configuration. 📦💧 This vulnerability in the GetValue functionality allows specially-crafted configuration values to cause a buffer overflow, exposing the multiWAN binary to exploitation. The flaw can lead to significant security risks if exploited by an attacker.

What to do

An attacker could trigger this overflow by modifying configuration values, potentially leading to unauthorized access or control over the device. This could even allow them to execute arbitrary code, which is nothing short of an open invitation for chaos! Update to the latest firmware as soon as possible, and ensure that all configurations are scrutinized to prevent unauthorized modifications. Regularly audit your devices to confirm that no exploits have occurred. 🔒 You're on the right track! Tackle this vulnerability now, and you'll have your network fortified in no time. 🛡️

The record
Technical detail
CVSS v3.0
9.6 · CRITICAL
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01305 · 70.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2022-08-05T21:15Z
EPSS history
Timeline
  • 05 AUG 21:15Z
    A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14
    cvelistv5