CVE-2022-24024CWE-120

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14

Critical · published August 5, 2022

CVSS v3.0
9.6
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

🔥 A crafty alteration of a configuration value is all it takes to unleash chaos! This buffer overflow vulnerability in the TCL LinkHub Mesh Wi-Fi could leave your network wide open to attack. 🚨 Think of it like a suitcase that’s been overpacked — if you force it shut, the contents might burst out in all directions! In this case, the specially-crafted configuration value acts as that overstuffed suitcase, leading to an overflow that can compromise the device’s integrity. An attacker could exploit this vulnerability to run arbitrary code, potentially gaining full control over your Wi-Fi network. This means they could snoop on your traffic, modify settings, and create a nightmare scenario for your connected devices! Absolutely devastating, right?

Put simply

Think of it like a suitcase that’s been overpacked — if you force it shut, the contents might burst out in all directions! In this case, the specially-crafted configuration value acts as that overstuffed suitcase, leading to an overflow that can compromise the device’s integrity. This buffer overflow in the GetValue functionality of TCL LinkHub can be triggered by modifying a configuration value, leading to potential execution of attacker-controlled code. It affects all occurrences of the buffer overflow vulnerability within the rtk_ate binary.

What to do

An attacker could exploit this vulnerability to run arbitrary code, potentially gaining full control over your Wi-Fi network. This means they could snoop on your traffic, modify settings, and create a nightmare scenario for your connected devices! Absolutely devastating, right? Immediately update your TCL LinkHub to the latest firmware version that addresses this vulnerability. Review your network settings and ensure there are no unauthorized changes. Consider implementing additional network security measures as a precaution. You've got this! Follow these steps, and you'll have your network back on lock in no time! 🛡️

The record
Technical detail
CVSS v3.0
9.6 · CRITICAL
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01305 · 70.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2022-08-05T21:16Z
EPSS history
Timeline
  • 05 AUG 21:16Z
    A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14
    cvelistv5