CVE-2022-24021CWE-120

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14

Critical · published August 5, 2022

CVSS v3.0
9.6
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

🚨 A crafty configuration value is all it takes to trigger a devastating buffer overflow in TCL LinkHub Mesh Wi-Fi devices! 🔥 Think of this vulnerability like a tiny, overflowing cup of coffee at a café. Just one more sip, and it spills all over the counter, causing a chaotic mess — that’s what happens when this buffer overflows! An attacker could exploit this vulnerability to gain control over the device, leading to potential data breaches or even taking over the entire network. This is absolutely devastating, as it puts your personal information and the integrity of your connected devices at risk!

Put simply

Think of this vulnerability like a tiny, overflowing cup of coffee at a café. Just one more sip, and it spills all over the counter, causing a chaotic mess — that’s what happens when this buffer overflows! This buffer overflow vulnerability in the GetValue function allows an attacker to modify a configuration value, potentially leading to arbitrary code execution within the online_process binary.

What to do

An attacker could exploit this vulnerability to gain control over the device, leading to potential data breaches or even taking over the entire network. This is absolutely devastating, as it puts your personal information and the integrity of your connected devices at risk! Immediately update your TCL LinkHub Mesh Wi-Fi to the latest firmware version that addresses this vulnerability. Additionally, review your network configurations to ensure no unauthorized settings are present, and consider implementing additional security measures like monitoring your network traffic. You've got this! Follow these steps, and you'll have your network fortified in no time! 🛡️

The record
Technical detail
CVSS v3.0
9.6 · CRITICAL
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01305 · 70.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2022-08-05T21:16Z
EPSS history
Timeline
  • 05 AUG 21:16Z
    A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14
    cvelistv5