CVE-2022-37801

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function formSetQosBand

published August 25, 2022

CVSS
—
EPSS
1%
Percentile
67.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky stack overflow is waiting in Tenda AC1206's QoS settings! This vulnerability sneaks in through the list parameter at the function formSetQosBand, and it’s a tricky one! Think of it like an overstuffed suitcase that bursts open when you try to zip it up — too much data in the list parameter can cause the system to overflow, leading to unexpected behaviors. If exploited, this stack overflow could lead to a system crash or allow an attacker to execute arbitrary code. While it may not be actively exploited yet, the consequences could be quite impactful if someone figures it out!

Put simply

Think of it like an overstuffed suitcase that bursts open when you try to zip it up — too much data in the list parameter can cause the system to overflow, leading to unexpected behaviors. This vulnerability occurs due to improper handling of input data in the list parameter, leading to a stack overflow in the formSetQosBand function, which could allow attackers to manipulate the program's execution flow.

What to do

If exploited, this stack overflow could lead to a system crash or allow an attacker to execute arbitrary code. While it may not be actively exploited yet, the consequences could be quite impactful if someone figures it out! Upgrade to the latest firmware version for the Tenda AC1206 to patch this vulnerability. Performing regular updates and audits on your network devices is also a good practice to prevent potential vulnerabilities from being exploited. You've got this! Stay vigilant, and your network will be safe and sound! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01200 · 67.9th percentile
Published
2022-08-25T14:04Z
EPSS history
Timeline
  • 25 AUG 14:04Z
    Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function formSetQosBand
    cvelistv5