CVE-2022-28556

HIGH

7.5

Description

Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin is vulnerable to Buffer Overflow. The stack overflow vulnerability lies in the /goform/setpptpservercfg interface of the web. The sent post data startip and endip are copied to the stack using the sanf function, resulting in stack overflow. Similarly, this vulnerability can be used together with CVE-2021-44971

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published5/4/2022

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

tenda:ac15tenda:ac15_firmware

Weaknesses (CWE)

CWE-787

References

https://github.com/doudoudedi/TendaAC15_vul/blob/main/TendaAC15-vul.md(cve@mitre.org)

https://github.com/doudoudedi/TendaAC15_vul/blob/main/TendaAC15-vul.md(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.