CVE-2023-41553

Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url…

published August 30, 2023

CVSS
—
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

⚠️ Who knew a stack overflow could cause such a ruckus? Tenda AC9 and AC5 models have a sneaky vulnerability hiding at /goform/SetStaticRouteCfg that could take down your router! Think of the router as a busy restaurant kitchen, where too many orders are sent in at once. If the kitchen gets overloaded, it might just collapse, causing chaos in the dining area. If exploited, this stack overflow could lead to service interruptions or even allow attackers to crash the router—think of it as the restaurant kitchen shutting down in the middle of dinner service! While there's no known exploit, the potential for disruption is still a concern.

Put simply

Think of the router as a busy restaurant kitchen, where too many orders are sent in at once. If the kitchen gets overloaded, it might just collapse, causing chaos in the dining area. This vulnerability stems from improper handling of parameter lists, allowing an attacker to send too much data and trigger a stack overflow, which can destabilize the device.

What to do

If exploited, this stack overflow could lead to service interruptions or even allow attackers to crash the router—think of it as the restaurant kitchen shutting down in the middle of dinner service! While there's no known exploit, the potential for disruption is still a concern. Update your Tenda AC9 to version V15.03.06.42_multi and Tenda AC5 to V15.03.06.28 to close this loophole. Keep an eye on Tenda's updates and apply any relevant patches promptly! This is fixable! Keep your devices updated, and you'll stay ahead of the game. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00838 · 57.4th percentile
Published
2023-08-30T00:00Z
EPSS history
Timeline
  • 30 AUG 00:00Z
    Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url…
    cvelistv5