CVE-2023-44022

Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan…

published September 27, 2023

CVSS
—
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky stack overflow lurks in the Tenda AC10U, just waiting for the right moment to crash the party! 🎉 Think of the speed_dir parameter as a crowded elevator. If you keep adding too many people without checking the weight limit, it’s just a matter of time before it collapses under the pressure! An attacker could potentially cause the device to crash, disrupting your network connectivity and leaving you in a bind. While this vulnerability isn't currently exploited, it could lead to service interruptions that are far from desirable for your online activities.

Put simply

Think of the speed_dir parameter as a crowded elevator. If you keep adding too many people without checking the weight limit, it’s just a matter of time before it collapses under the pressure! This vulnerability stems from a stack overflow that occurs in the formSetSpeedWan function when the speed_dir parameter is manipulated. If exploited, it could crash the service handling the request.

What to do

An attacker could potentially cause the device to crash, disrupting your network connectivity and leaving you in a bind. While this vulnerability isn't currently exploited, it could lead to service interruptions that are far from desirable for your online activities. To mitigate this risk, ensure that you update your router firmware to the latest version (check for updates beyond v15.03.06.49). Additionally, consider reviewing and validating input parameters to prevent unexpected values. You've got this! Stay vigilant and patch that firmware to keep your network secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01120 · 65.9th percentile
Published
2023-09-27T00:00Z
EPSS history
Timeline
  • 27 SEP 00:00Z
    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan…
    cvelistv5