CVE-2022-37802

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromNatStaticSetting

published August 25, 2022

CVSS
—
EPSS
1%
Percentile
67.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky stack overflow hides in the function for NAT settings! The Tenda AC1206 is vulnerable via the page parameter, and it could cause unexpected behavior. 🔥 Think of it like a restaurant where the chef is given the wrong ingredients and has to improvise quickly. If there’s too much being thrown in, the dish could overflow and create a messy situation in the kitchen. An attacker could exploit this stack overflow to crash the router or potentially execute harmful code, causing your network to behave unexpectedly. This might lead to interruptions in service or even unauthorized access to connected devices!

Put simply

Think of it like a restaurant where the chef is given the wrong ingredients and has to improvise quickly. If there’s too much being thrown in, the dish could overflow and create a messy situation in the kitchen. The vulnerability arises in the function fromNatStaticSetting, where improper handling of the page parameter can lead to a stack overflow, making the router susceptible to crashes or malicious payload execution.

What to do

An attacker could exploit this stack overflow to crash the router or potentially execute harmful code, causing your network to behave unexpectedly. This might lead to interruptions in service or even unauthorized access to connected devices! To protect your network, immediately update your Tenda AC1206 firmware to the latest version. Regularly check for patches and consider implementing network segmentation to limit exposure while a full update is in progress. You’ve got this! With a few updates, you can ensure your network stays safe and sound. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01200 · 67.9th percentile
Published
2022-08-25T14:04Z
EPSS history
Timeline
  • 25 AUG 14:04Z
    Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromNatStaticSetting
    cvelistv5