CVE-2023-51092

Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade

High · published December 26, 2023

CVSS v3.1
8.8
EPSS
13%
Percentile
96.3
In the wild
Unconfirmed
What it is

⚡ A stack overflow lurking in Tenda M3 routers could turn your network into a playground for attackers! 🚨 Think of it like a water tank overflowing because someone opened the tap too wide — it can cause a flood if not managed. In this case, the 'tap' is the upgrade function, and when it’s improperly handled, it spills over. An attacker could exploit this vulnerability to gain control over the device, potentially leading to unauthorized access to your network. This could be a significant threat, allowing attackers to manipulate traffic, intercept data, or even launch further attacks on connected devices.

Put simply

Think of it like a water tank overflowing because someone opened the tap too wide — it can cause a flood if not managed. In this case, the 'tap' is the upgrade function, and when it’s improperly handled, it spills over. The vulnerability in Tenda M3 arises from improper handling of input in the upgrade function, causing a stack overflow that can lead to arbitrary code execution.

What to do

An attacker could exploit this vulnerability to gain control over the device, potentially leading to unauthorized access to your network. This could be a significant threat, allowing attackers to manipulate traffic, intercept data, or even launch further attacks on connected devices. To mitigate this, immediately update your Tenda M3 router to the latest firmware version to close this security hole. Additionally, consider reviewing your network settings and access controls to ensure they are robust against unauthorized access. You’ve got this! By taking these steps, you’re improving your home network’s security in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.12913 · 96.3th percentile
Published
2023-12-26T00:00Z
EPSS history
Timeline
  • 26 DEC 00:00Z
    Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade
    cvelistv5