CVE-2022-25457

Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function

published March 18, 2022

CVSS
โ€”
EPSS
2%
Percentile
76.9
In the wild
Unconfirmed
What it is

โš ๏ธ A stack overflow in Tenda AC6 could turn your router into a ticking time bomb! ๐Ÿ’ฃ Think of it like a water pipe that gets so clogged with debris that it bursts โ€” one little misconfiguration can cause a serious overflow, leading to chaos! An attacker could exploit this overflow to disrupt the router's functionality, potentially causing it to crash or behave unpredictably. In a worst-case scenario, this could lead to a permanent denial of service, leaving your network vulnerable and offline.

Put simply

Think of it like a water pipe that gets so clogged with debris that it bursts โ€” one little misconfiguration can cause a serious overflow, leading to chaos! This vulnerability resides in the SetSysTimeCfg function, where an improperly handled ntpserver parameter can lead to a stack overflow, allowing attackers to corrupt memory, which may impact the device's stability.

What to do

An attacker could exploit this overflow to disrupt the router's functionality, potentially causing it to crash or behave unpredictably. In a worst-case scenario, this could lead to a permanent denial of service, leaving your network vulnerable and offline. Upgrade your Tenda AC6 firmware to the latest version available to patch this vulnerability. Regularly check for updates to ensure your devices are secure and functioning optimally. Don't forget to audit your configurations for best practices! You've got this! Stay proactive and keep your network running smoothly. ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01692 ยท 76.9th percentile
Published
2022-03-18T20:53Z
EPSS history
Timeline
  • 18 MAR 20:53Z
    Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function
    cvelistv5