Paper/Archive/CVE-2023-38931

CVE-2023-38931

tenda ac10 — Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5…

EPSS 0.8%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 57.8.578 × 2011.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and FH1203 V2.0.1.6 were discovered to contain a stack overflow via the list parameter in the setaccount function.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

ac10V1.0 V15.03.06.23–CISA-ADP

ac1206V15.03.06.23–CISA-ADP

ac8v4 V16.03.34.06–CISA-ADP

ac6V2.0 V15.03.06.23–CISA-ADP

ac7V1.0 V15.03.06.44–CISA-ADP

f1203V2.0.1.6–CISA-ADP

ac5V1.0 V15.03.06.28–CISA-ADP

ac10v4.0 V16.03.10.13–CISA-ADP

fh1203V2.0.1.6–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/FirmRec/IoT-Vulns/blob/main/tenda/cloudv2_setaccount/README.md