CVE-2022-25073

TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr()

published February 22, 2022

CVSS
—
EPSS
13%
Percentile
96.3
In the wild
Unconfirmed
What it is

⚠️ A little stack overflow could lead to big trouble! An unauthenticated attacker can exploit a flaw in TL-WR841N v14 routers to run arbitrary code! Think of it like a delivery truck that just accepts the first package it sees, even if it’s not meant for them — this vulnerability lets hackers send anything in without a proper check! If successfully exploited, an attacker could seize control of your router, potentially snooping on your network traffic or redirecting data. The consequences could ripple through your entire home or office network, making this a vulnerability worth taking seriously!

Put simply

Think of it like a delivery truck that just accepts the first package it sees, even if it’s not meant for them — this vulnerability lets hackers send anything in without a proper check! This stack overflow vulnerability in the function dm_fillObjByStr() allows attackers to execute arbitrary code by sending specially crafted data to the router, bypassing authentication entirely.

What to do

If successfully exploited, an attacker could seize control of your router, potentially snooping on your network traffic or redirecting data. The consequences could ripple through your entire home or office network, making this a vulnerability worth taking seriously! To protect your network, consider updating your router firmware to the latest version provided by TP-Link. Regularly check for new patches and configure your router's security settings to limit access. Don't forget to change default passwords as well! You can tackle this! By staying proactive, you're already a security hero! 🦸

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13034 · 96.3th percentile
Published
2022-02-22T22:44Z
EPSS history
Timeline
  • 22 FEB 22:44Z
    TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr()
    cvelistv5