CVE-2022-24028CWE-120

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14

Critical · published August 5, 2022

CVSS v3.0
9.6
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

🔥 A specially-crafted configuration value can open the floodgates for disaster! With a messy buffer overflow lurking in TCL LinkHub Mesh Wi-Fi, an attacker could wreak havoc without breaking a sweat! Think of it like a traffic jam caused by a single oversized delivery truck squeezing through a narrow street — everything gets blocked, and chaos ensues. Here, the buffer overflow allows an attacker to push beyond the limits, leading to overflow and potential control over the system. An attacker could exploit this vulnerability to cause major disruptions, potentially allowing them to execute arbitrary code, alter system configurations, or even crash the entire device. This is absolutely devastating for your network security!

Put simply

Think of it like a traffic jam caused by a single oversized delivery truck squeezing through a narrow street — everything gets blocked, and chaos ensues. Here, the buffer overflow allows an attacker to push beyond the limits, leading to overflow and potential control over the system. The vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi due to a buffer overflow when handling specially-crafted configuration values. This affects the libcommonprod.so binary, making the flaw far-reaching.

What to do

An attacker could exploit this vulnerability to cause major disruptions, potentially allowing them to execute arbitrary code, alter system configurations, or even crash the entire device. This is absolutely devastating for your network security! Immediate action is a must! Patch your device to the latest firmware version released by TCL. Additionally, review configuration settings and monitor traffic for any suspicious activity to ensure safety. You've got this! Secure your network and keep it strong! 🛡️

The record
Technical detail
CVSS v3.0
9.6 · CRITICAL
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01305 · 70.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2022-08-05T21:17Z
EPSS history
Timeline
  • 05 AUG 21:17Z
    A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14
    cvelistv5