CVE-2023-50986

Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function

High · published December 20, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

⚡ A sneaky buffer overflow lurks in the Tenda i29, ready to exploit an unsuspecting time parameter in the sysLogin function! Think of it like an overstuffed mailbox that can't handle one more letter — as the extra input spills over, it could disrupt everything inside, leaving a space for mischief. An attacker could leverage this flaw to execute arbitrary code, potentially taking complete control of your device. This could lead to data breaches or unauthorized access, turning your trusted network device into a hostile entity!

Put simply

Think of it like an overstuffed mailbox that can't handle one more letter — as the extra input spills over, it could disrupt everything inside, leaving a space for mischief. This vulnerability occurs due to a buffer overflow when the time parameter is improperly handled in the sysLogin function, allowing attackers to overwrite memory and execute malicious code.

What to do

An attacker could leverage this flaw to execute arbitrary code, potentially taking complete control of your device. This could lead to data breaches or unauthorized access, turning your trusted network device into a hostile entity! To protect yourself, patch the i29 to version 1.0.0.6 immediately. Also, review your configuration to ensure no insecure parameters are accessible. Regularly monitoring for firmware updates will help keep your devices secure! You've got this! With these steps, you'll keep your network safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00769 · 55.1th percentile
Published
2023-12-20T00:00Z
EPSS history
Timeline
  • 20 DEC 00:00Z
    Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function
    cvelistv5