CVE-2022-37799

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter at the function setSmartPowerManagement

published August 25, 2022

CVSS
—
EPSS
1%
Percentile
67.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky stack overflow is hiding in Tenda AC1206! The function setSmartPowerManagement can be triggered by a cleverly crafted 'time' parameter — almost like slipping an extra sandwich into a lunch order without anyone noticing! Think of it as a waiter who just keeps piling sandwiches onto the same plate without checking if the plate can handle it. Eventually, it overflows and makes a mess everywhere! If exploited, this vulnerability could lead to a system crash or unexpected behavior, causing serious interruptions for users. No data loss is expected, but the disruption could be frustrating for anyone relying on the device.

Put simply

Think of it as a waiter who just keeps piling sandwiches onto the same plate without checking if the plate can handle it. Eventually, it overflows and makes a mess everywhere! This vulnerability allows for a stack overflow through a maliciously manipulated 'time' parameter in the setSmartPowerManagement function, which could potentially disrupt normal operations by overflowing the stack.

What to do

If exploited, this vulnerability could lead to a system crash or unexpected behavior, causing serious interruptions for users. No data loss is expected, but the disruption could be frustrating for anyone relying on the device. To mitigate this risk, update the Tenda AC1206 firmware to the latest version available. Regularly check for updates and consider implementing additional input validation to catch anomalies like this one. You've got this! With these steps, you'll help keep your network safe and sound. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01200 · 67.9th percentile
Published
2022-08-25T14:04Z
EPSS history
Timeline
  • 25 AUG 14:04Z
    Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter at the function setSmartPowerManagement
    cvelistv5