CVE-2024-44556

Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo

Medium · published August 26, 2024

CVSS v3.1
6.6
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

⚠️ A mischievous stack overflow lurks in Tenda AX1806, waiting for someone to trip over the adv.iptv.stballvlans parameter! 🌪️ Think of this vulnerability like a crowded elevator that suddenly gains too many passengers — it’s bound to buckle under the pressure. In this case, an attacker could exploit the overflow and push the system beyond its limits. If exploited, this stack overflow could lead to unexpected behavior or even crashes, making your network devices unreliable. While it isn't actively being exploited, the potential for disruption is still a risk that shouldn’t be ignored!

Put simply

Think of this vulnerability like a crowded elevator that suddenly gains too many passengers — it’s bound to buckle under the pressure. In this case, an attacker could exploit the overflow and push the system beyond its limits. This vulnerability arises in the Tenda AX1806's setIptvInfo function, where improper handling of the adv.iptv.stballvlans parameter can lead to a stack overflow, allowing an attacker to manipulate the application's memory.

What to do

If exploited, this stack overflow could lead to unexpected behavior or even crashes, making your network devices unreliable. While it isn't actively being exploited, the potential for disruption is still a risk that shouldn’t be ignored! To remediate this issue, update the Tenda AX1806 firmware to the latest version available. Regularly check for patches and monitor your network devices for any unusual activity! You've got this! Follow these steps and you're one step closer to securing your network! 🛡️

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.5th percentile
Published
2024-08-26T00:00Z
EPSS history
Timeline
  • 26 AUG 00:00Z
    Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo
    cvelistv5