CVE-2023-51958

Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv

Critical · published January 10, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

🔥 A sneaky stack overflow hides in Tenda AX1803 that could wreak havoc with just the right input! Think of it like ordering a pizza with too many toppings — if you keep piling on the requests, the kitchen can get overwhelmed and mess up the entire order. In this case, the iptv.stb.port parameter is that overloaded order ticket, leading to a crash instead of a tasty slice. If exploited, this vulnerability could cause the device to crash, leaving your network vulnerable and potentially allowing an attacker to execute arbitrary code. Imagine losing control over your home internet setup — absolutely devastating!

Put simply

Think of it like ordering a pizza with too many toppings — if you keep piling on the requests, the kitchen can get overwhelmed and mess up the entire order. In this case, the iptv.stb.port parameter is that overloaded order ticket, leading to a crash instead of a tasty slice. This stack overflow occurs in the formGetIptv function when the iptv.stb.port parameter is fed with excessively large input, pushing it beyond its limits and leading to a system crash.

What to do

If exploited, this vulnerability could cause the device to crash, leaving your network vulnerable and potentially allowing an attacker to execute arbitrary code. Imagine losing control over your home internet setup — absolutely devastating! Patch your Tenda AX1803 to version 1.0.0.2 immediately to close this hole. Review your input validation processes to prevent such overflow vulnerabilities in the future. You've got this! Follow these steps to secure your device and keep your network safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00701 · 52.7th percentile
Published
2024-01-10T00:00Z
EPSS history
Timeline
  • 10 JAN 00:00Z
    Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv
    cvelistv5