CVE-2022-41522

TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function

published October 6, 2022

CVSS
—
EPSS
1%
Percentile
64.5
In the wild
Unconfirmed
What it is

⚠️ An unauthenticated stack overflow in the TOTOLINK NR1800X could let attackers bend the network to their will! This flaw is like a guest trying to sneak into a concert without a ticket and then taking over the sound system — all thanks to a simple oversight in the access controls! If exploited, an attacker could leverage this stack overflow to execute arbitrary code, potentially taking full control over the router. This means they could tamper with your settings, intercept communications, or even kick you off your own network — absolutely devastating!

Put simply

This flaw is like a guest trying to sneak into a concert without a ticket and then taking over the sound system — all thanks to a simple oversight in the access controls! The vulnerability occurs in the 'main' function of the router's firmware, allowing attackers to trigger a stack overflow due to insufficient input validation, leading to potential remote code execution.

What to do

If exploited, an attacker could leverage this stack overflow to execute arbitrary code, potentially taking full control over the router. This means they could tamper with your settings, intercept communications, or even kick you off your own network — absolutely devastating! To protect your network, update your TOTOLINK NR1800X firmware to the latest version immediately. Check the manufacturer's website for any patches or updates that address this vulnerability. It’s a good idea to review your device configurations for any unauthorized settings as well. You've got this! Follow these steps and you'll have your network secure in no time. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01066 · 64.5th percentile
Published
2022-10-06T00:00Z
EPSS history
Timeline
  • 06 OCT 00:00Z
    TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function
    cvelistv5