CVE-2022-43103

Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function

Critical · published November 3, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

🚨 A single parameter in the Tenda AC23 could lead to a devastating stack overflow! This vulnerability is a ticking time bomb for your network security. 🔥 Think of it like overstuffing a suitcase—too much in one spot, and it bursts open, spilling everything everywhere. This flaw allows attackers to push the limits, causing chaos that could compromise your entire system! With this stack overflow, an attacker could potentially gain unauthorized control of the device, allowing them to execute arbitrary code. This means they could change settings, intercept traffic, or even bring your network to its knees in an instant—talk about a rough day at the office!

Put simply

Think of it like overstuffing a suitcase—too much in one spot, and it bursts open, spilling everything everywhere. This flaw allows attackers to push the limits, causing chaos that could compromise your entire system! The flaw lies in the 'list' parameter of the formSetQosBand function, where excessive data input leads to a stack overflow, enabling remote code execution. Essentially, this mishap gives attackers an open invitation to your network's inner workings.

What to do

With this stack overflow, an attacker could potentially gain unauthorized control of the device, allowing them to execute arbitrary code. This means they could change settings, intercept traffic, or even bring your network to its knees in an instant—talk about a rough day at the office! Immediately patch your Tenda AC23 to the latest version to close this vulnerability. It's crucial to implement validation on input parameters to prevent such overflow incidents from occurring in the future. Regularly reviewing security settings will also bolster your defenses! You've got this! Take action, and you'll transform into a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00992 · 62.2th percentile
Published
2022-11-03T00:00Z
EPSS history
Timeline
  • 03 NOV 00:00Z
    Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function
    cvelistv5