CVE-2022-25740CWE-120

Buffer Copy Without Checking Size of Input in MODEM

Critical · published April 4, 2023

CVSS v3.1
9.8
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

🔥 A memory corruption bug is lurking in the modem, ready to wreak havoc from a simple buffer overwrite while building an IPv6 multicast address! Think of it like a delivery service that misaddresses a package. If the address is incorrectly formatted, it could end up in the wrong hands—leading to chaos on the network! If exploited, an attacker could potentially manipulate the modem's functions, leading to unauthorized access, data breaches, or even a complete system crash. This vulnerability poses a serious risk to network integrity, as it could compromise communication and data transfer across devices.

Put simply

Think of it like a delivery service that misaddresses a package. If the address is incorrectly formatted, it could end up in the wrong hands—leading to chaos on the network! This vulnerability occurs due to a buffer overwrite in the modem when constructing an IPv6 multicast address based on the MAC address of the interface. This flaw can lead to memory corruption, allowing an attacker to execute arbitrary code.

What to do

If exploited, an attacker could potentially manipulate the modem's functions, leading to unauthorized access, data breaches, or even a complete system crash. This vulnerability poses a serious risk to network integrity, as it could compromise communication and data transfer across devices. Immediately patch to the latest firmware version provided by the manufacturer to fix the memory corruption issue. Review your network configurations and monitor for any unusual activity. Regularly updating your devices helps mitigate similar risks in the future. You've got this! With timely action, you can safeguard your network and keep everything running smoothly! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00417 · 35.0th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2023-04-04T04:46Z
EPSS history
Timeline
  • 04 APR 04:46Z
    Buffer Copy Without Checking Size of Input in MODEM
    cvelistv5