CVE-2023-44018

Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain parameter in the add_white_node function

High · published September 27, 2023

CVSS v3.1
8.8
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

⚡ A sneaky stack overflow is hiding in Tenda AC10U! The add_white_node function doesn’t handle its domain parameter well, leading to potential exploits. 🔥 Think of it like a restaurant that accepts any menu item without checking if the kitchen can actually make it. If a customer orders something way out there, it could break the whole system! An attacker could send specially crafted requests that overflow the stack, potentially leading to unauthorized access or service disruption. This could mean lost data, system crashes, or even worse—compromised networks!

Put simply

Think of it like a restaurant that accepts any menu item without checking if the kitchen can actually make it. If a customer orders something way out there, it could break the whole system! This stack overflow vulnerability in Tenda AC10U arises from inadequate validation of the domain parameter in the add_white_node function, allowing for malicious input that can cause the system to behave unpredictably.

What to do

An attacker could send specially crafted requests that overflow the stack, potentially leading to unauthorized access or service disruption. This could mean lost data, system crashes, or even worse—compromised networks! To secure your devices, update the firmware to the latest version as soon as it’s available. Regularly audit your configurations for potential vulnerabilities, and consider implementing stricter input validation on server functions. You've got this! Follow these steps, and you'll be well on your way to locking down your Tenda AC10U. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15769 · 96.9th percentile
Published
2023-09-27T00:00Z
EPSS history
Timeline
  • 27 SEP 00:00Z
    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain parameter in the add_white_node function
    cvelistv5