CVE-2023-51953

Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv

Critical · published January 10, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

🔥 A single mishandled parameter is the key to a stack overflow in Tenda AX1803! Think of it as a restaurant that overfills a pot with soup until it spills all over the kitchen floor—this stack overflow could lead to a server crash, leaving a mess that attackers can exploit! An attacker could leverage this vulnerability to crash the device or even execute arbitrary code, potentially taking complete control of the system. Imagine a hacker sneaking in through the unlocked back door and wreaking havoc—absolutely devastating!

Put simply

Think of it as a restaurant that overfills a pot with soup until it spills all over the kitchen floor—this stack overflow could lead to a server crash, leaving a mess that attackers can exploit! This vulnerability arises from improper handling of the iptv.stb.mode parameter in the formSetIptv function, leading to a stack overflow that can be exploited for remote code execution.

What to do

An attacker could leverage this vulnerability to crash the device or even execute arbitrary code, potentially taking complete control of the system. Imagine a hacker sneaking in through the unlocked back door and wreaking havoc—absolutely devastating! Immediate action is required! Update the Tenda AX1803 firmware to the latest version to close this critical vulnerability. Review your network's security settings and consider additional protections against unauthorized access. You’ve got this! Follow these steps and you’ll keep your network secure in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00701 · 52.6th percentile
Published
2024-01-10T00:00Z
EPSS history
Timeline
  • 10 JAN 00:00Z
    Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv
    cvelistv5