CVE-2022-25437

Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function

published March 18, 2022

CVSS
—
EPSS
2%
Percentile
76.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky stack overflow lurks in the Tenda AC9! This vulnerability appears in the SetVirtualServerCfg function, ready to trip up the unprepared. 🔥 Think of it like overstuffing a suitcase; if you cram in too much, the zipper pops, and everything spills out. Here, the 'list' parameter is that zipper, and a crafty attacker could exploit it to unleash chaos. If exploited, this stack overflow could cause the router to crash or behave unexpectedly, disrupting your network. It’s like a sudden traffic jam on your internet highway, leaving you stuck without connection until things are sorted out!

Put simply

Think of it like overstuffing a suitcase; if you cram in too much, the zipper pops, and everything spills out. Here, the 'list' parameter is that zipper, and a crafty attacker could exploit it to unleash chaos. The vulnerability arises from improper handling of input in the 'list' parameter of the SetVirtualServerCfg function, allowing stack overflow conditions when too much data is sent.

What to do

If exploited, this stack overflow could cause the router to crash or behave unexpectedly, disrupting your network. It’s like a sudden traffic jam on your internet highway, leaving you stuck without connection until things are sorted out! To secure your network, update your Tenda AC9 to the latest firmware version. Regularly check for updates and implement input validation to ensure the 'list' parameter is handled safely. 🛡️ You've got this! With these fixes, your network will be in tip-top shape. 💪✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01692 · 76.9th percentile
Published
2022-03-18T20:53Z
EPSS history
Timeline
  • 18 MAR 20:53Z
    Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function
    cvelistv5