CVE-2022-43260

Tenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in the fromSetSysTime function

Critical · published October 18, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
62.4
In the wild
Unconfirmed
What it is

🔥 A clever stack overflow lurking in Tenda AC18 could turn your router into a hacker's playground! Think of it like a shelf in a supermarket where one misplaced item can cause an entire row to collapse — this stack overflow can let an attacker take control, toppling everything in their path! An attacker could exploit this vulnerability to execute arbitrary code, potentially leading to a complete takeover of your network. This means they could snoop on your data, alter configurations, or even deploy malware — absolutely devastating for any home or business!

Put simply

Think of it like a shelf in a supermarket where one misplaced item can cause an entire row to collapse — this stack overflow can let an attacker take control, toppling everything in their path! The vulnerability arises from a stack overflow triggered by the time parameter in the fromSetSysTime function, allowing attackers to overwrite the return address and execute malicious code.

What to do

An attacker could exploit this vulnerability to execute arbitrary code, potentially leading to a complete takeover of your network. This means they could snoop on your data, alter configurations, or even deploy malware — absolutely devastating for any home or business! Immediately patch your Tenda AC18 router to version V15.03.05.20 or later to eliminate this risk. Additionally, consider disabling remote management features if they are not needed, and regularly check for firmware updates to stay one step ahead of threats. You've got this! With these steps, you’ll have your network secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00996 · 62.4th percentile
Published
2022-10-18T00:00Z
EPSS history
Timeline
  • 18 OCT 00:00Z
    Tenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in the fromSetSysTime function
    cvelistv5