CVE-2022-47118

Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet

Critical · published December 30, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

🚨 A stack overflow in Tenda's A15 router can be triggered by a simple parameter tweak, opening the door to serious security risks! 🔥 It's like a hotel reservation system that lets any guest book an infinite number of rooms without checking their ID, flooding the system with more requests than it can handle. An attacker exploiting this vulnerability could crash the router, potentially disrupting your entire network! Imagine losing your internet connection during a crucial video call or while streaming your favorite show. The chaos could be absolutely devastating!

Put simply

It's like a hotel reservation system that lets any guest book an infinite number of rooms without checking their ID, flooding the system with more requests than it can handle. This stack overflow vulnerability occurs through improper handling of the 'wepkey1' parameter at /goform/WifiBasicSet, allowing attackers to send crafted requests that overwhelm the system.

What to do

An attacker exploiting this vulnerability could crash the router, potentially disrupting your entire network! Imagine losing your internet connection during a crucial video call or while streaming your favorite show. The chaos could be absolutely devastating! Update your Tenda A15 firmware to version V15.13.07.14 or later immediately to patch this vulnerability. Additionally, review your network configurations and restrict access to trusted users only. Regularly check for firmware updates to stay protected! You've got this! Follow these steps and lock down your network like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00882 · 58.8th percentile
Published
2022-12-30T00:00Z
EPSS history
Timeline
  • 30 DEC 00:00Z
    Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet
    cvelistv5