CVE-2023-27020

Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the saveParentControlInfo function

Critical · published April 7, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
64.5
In the wild
Unconfirmed
What it is

🚨 A sneaky stack overflow lurking in the Tenda AC10 could let attackers run wild! We're talking potential Denial of Service or arbitrary code execution with just the right crafted payload! 🔥 Think of this vulnerability like a clogged drain in a restaurant kitchen. If too much waste gets pushed through without checks, the whole system can back up, causing a chaotic mess that halts all operations—nobody's getting served until it's fixed! An attacker could exploit this critical vulnerability to crash the router, leaving your network inoperable and vulnerable. Worse yet, they could execute arbitrary code, putting sensitive information and devices at risk. This is absolutely devastating for any user relying on the device!

Put simply

Think of this vulnerability like a clogged drain in a restaurant kitchen. If too much waste gets pushed through without checks, the whole system can back up, causing a chaotic mess that halts all operations—nobody's getting served until it's fixed! This vulnerability arises from a stack overflow in the saveParentControlInfo function, which can be triggered by a specially crafted payload, causing it to execute unexpected commands or crash the system altogether.

What to do

An attacker could exploit this critical vulnerability to crash the router, leaving your network inoperable and vulnerable. Worse yet, they could execute arbitrary code, putting sensitive information and devices at risk. This is absolutely devastating for any user relying on the device! To protect your network, update the Tenda AC10 firmware to the latest version as soon as possible. Ensure your devices are not relying on vulnerable software, and consider implementing firewall rules to limit external access while you patch. Don't forget to regularly audit your devices! You've got this! Follow these steps, and you'll strengthen your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01069 · 64.5th percentile
Published
2023-04-07T00:00Z
EPSS history
Timeline
  • 07 APR 00:00Z
    Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the saveParentControlInfo function
    cvelistv5