PT-2022-16493 · Tenda · Tenda Ax3+1

Published 2022-02-04 · Updated 2022-03-01 · CVE-2022-24143

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Tenda AX3 version 16.03.12.10 CN Tenda AX12 version 22.03.01.2 CN

Description A stack overflow was discovered in the form fast setting wifi set function, allowing attackers to cause a Denial of Service (DoS) via the timeZone parameter.

Recommendations For Tenda AX3 version 16.03.12.10 CN, consider disabling the form fast setting wifi set function until a patch is available. For Tenda AX12 version 22.03.01.2 CN, restrict access to the timeZone parameter in the affected API endpoint until the issue is resolved. Avoid using the timeZone parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-24143

Affected Products

Tenda Ax12

Tenda Ax3

References · 5

• 🔥❌ https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_17/17.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-24143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24143 · Security Note
• https://t.me/cvenotify/27529 · Telegram Post
• https://t.me/cvenotify/26539 · Telegram Post