CVE-2023-37705

Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromAddressNat function

published July 10, 2023

CVSS
—
EPSS
1%
Percentile
66.7
In the wild
Unconfirmed
What it is

⚠️ A sneaky stack overflow lurks in Tenda FH1203, waiting for the right moment to create chaos! Imagine a restaurant where the chef keeps trying to pour a gallon of sauce into a pint-sized container — eventually, it overflows and creates a big mess! That's similar to how the stack overflow works in this router's function, potentially spilling sensitive data or causing a crash. An attacker could exploit this stack overflow to manipulate the router, leading to unexpected behavior or service interruptions. While there’s no immediate report of exploitation, the potential for disruption is absolutely concerning!

Put simply

Imagine a restaurant where the chef keeps trying to pour a gallon of sauce into a pint-sized container — eventually, it overflows and creates a big mess! That's similar to how the stack overflow works in this router's function, potentially spilling sensitive data or causing a crash. This vulnerability arises in the `fromAddressNat` function where the `page` parameter is mishandled, creating an opportunity for a stack overflow and allowing an attacker to cause the system to misbehave or crash.

What to do

An attacker could exploit this stack overflow to manipulate the router, leading to unexpected behavior or service interruptions. While there’s no immediate report of exploitation, the potential for disruption is absolutely concerning! To remediate this, ensure you update the firmware of your Tenda FH1203 router to the latest version as soon as it's available. Regularly check for updates to avoid any mishaps in the future! You've got this! Stay proactive and keep your devices secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01153 · 66.7th percentile
Published
2023-07-10T00:00Z
EPSS history
Timeline
  • 10 JUL 00:00Z
    Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromAddressNat function
    cvelistv5