CVE-2023-47456

Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWirelessRepeat

Critical · published November 7, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
56.2
In the wild
Unconfirmed
What it is

🔥 A stack overflow lurks in Tenda AX1806 V1.0.0.1 that could let attackers run wild! Think of it like a restaurant where one bad order causes the entire kitchen to overflow with food, creating chaos. Here, an attacker can trigger an overstuffed stack, potentially taking control as if they were the head chef! An attacker could exploit this vulnerability to execute malicious code in the device's memory, effectively hijacking the router. This could lead to unauthorized access to your network, allowing them to intercept traffic and even control connected devices. The consequences are absolutely devastating if left unchecked!

Put simply

Think of it like a restaurant where one bad order causes the entire kitchen to overflow with food, creating chaos. Here, an attacker can trigger an overstuffed stack, potentially taking control as if they were the head chef! This vulnerability in the Tenda AX1806 arises from unchecked input in the function sub_455D4, which is called during the operation of 'fromSetWirelessRepeat'. It allows for a stack overflow due to inadequate boundary checks, making it ripe for exploitation.

What to do

An attacker could exploit this vulnerability to execute malicious code in the device's memory, effectively hijacking the router. This could lead to unauthorized access to your network, allowing them to intercept traffic and even control connected devices. The consequences are absolutely devastating if left unchecked! Patch your Tenda AX1806 router immediately to version 1.0.0.2 or later to eliminate this vulnerability. Additionally, consider disabling any unnecessary features or services that could increase your attack surface while you assess your network's security posture. You've got this! Take these steps, and you'll have your security fortress up and running in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00801 · 56.2th percentile
Published
2023-11-07T00:00Z
EPSS history
Timeline
  • 07 NOV 00:00Z
    Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWirelessRepeat
    cvelistv5