CVE-2023-27015

Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_4A75C0 function

Critical · published April 7, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

🔥 A crafty payload can trigger a stack overflow in Tenda AC10 routers, turning them into chaos machines!⚠️ Imagine a restaurant where a chef accepts any ingredient without checking — one bad order can ruin the entire menu! In this case, the vulnerability allows attackers to flood the system, causing it to crash or even execute harmful commands without oversight. An attacker could exploit this flaw to cause a Denial of Service (DoS), effectively shutting down your router's functionality, or worse, they could run arbitrary code, compromising your whole network. The consequences could be absolutely devastating, leaving your devices vulnerable to further attacks or misuse.

Put simply

Imagine a restaurant where a chef accepts any ingredient without checking — one bad order can ruin the entire menu! In this case, the vulnerability allows attackers to flood the system, causing it to crash or even execute harmful commands without oversight. This vulnerability, residing in the sub_4A75C0 function, allows for a stack overflow when processed with a specially crafted payload, enabling attackers to disrupt services or execute unauthorized code.

What to do

An attacker could exploit this flaw to cause a Denial of Service (DoS), effectively shutting down your router's functionality, or worse, they could run arbitrary code, compromising your whole network. The consequences could be absolutely devastating, leaving your devices vulnerable to further attacks or misuse. To mitigate this risk, immediately update the Tenda AC10 firmware to the latest version if available. Regularly audit your router settings and consider implementing network segmentation to protect critical devices. Don't forget to change default passwords to strengthen your defenses! You've got this! Follow these steps, and you’ll be well on your way to securing your network from this threat. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01127 · 66.1th percentile
Published
2023-04-07T00:00Z
EPSS history
Timeline
  • 07 APR 00:00Z
    Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_4A75C0 function
    cvelistv5