Sign-up

ID

VAR-202203-0589


CVE

CVE-2022-25439


TITLE

Tenda AC9 Buffer Overflow Vulnerability (CNVD-2022-26246)

Trust: 0.6

sources: CNVD: CNVD-2022-26246

DESCRIPTION

Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function. The Tenda AC9 is a wireless router from the Chinese company Tenda. There is a buffer overflow vulnerability in Tenda AC9 15.03.2.21. The vulnerability arises from the fact that when the list parameter in the SetIpMacBind function performs operations on memory, the data boundary is not properly verified. An attacker can exploit this vulnerability to cause arbitrary command execution

Trust: 1.44

sources: NVD: CVE-2022-25439 // CNVD: CNVD-2022-26246

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-26246

AFFECTED PRODUCTS

vendor:tendamodel:ac9scope:eqversion:15.03.2.21

Trust: 1.0

vendor:tendamodel:ac9scope:eqversion:v15.03.2.21

Trust: 0.6

sources: CNVD: CNVD-2022-26246 // NVD: CVE-2022-25439

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-25439
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2022-26246
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202203-1849
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2022-25439
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2022-26246
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-25439
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2022-26246 // CNNVD: CNNVD-202203-1849 // NVD: CVE-2022-25439

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

sources: NVD: CVE-2022-25439

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202203-1849

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202203-1849

PATCH

title:Patch for Tenda AC9 Buffer Overflow Vulnerability (CNVD-2022-26246)url:https://www.cnvd.org.cn/patchInfo/show/328716

Trust: 0.6

title:Tenda AC9 Fixes for command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=186930

Trust: 0.6

sources: CNVD: CNVD-2022-26246 // CNNVD: CNNVD-202203-1849

EXTERNAL IDS

db:NVDid:CVE-2022-25439

Trust: 2.2

db:CNVDid:CNVD-2022-26246

Trust: 0.6

db:CNNVDid:CNNVD-202203-1849

Trust: 0.6

sources: CNVD: CNVD-2022-26246 // CNNVD: CNNVD-202203-1849 // NVD: CVE-2022-25439

REFERENCES

url:https://github.com/ephaha/iot_vuln/tree/main/tenda/ac9/8

Trust: 2.2

url:https://cxsecurity.com/cveshow/cve-2022-25439/

Trust: 0.6

sources: CNVD: CNVD-2022-26246 // CNNVD: CNNVD-202203-1849 // NVD: CVE-2022-25439

SOURCES

db:CNVDid:CNVD-2022-26246
db:CNNVDid:CNNVD-202203-1849
db:NVDid:CVE-2022-25439

LAST UPDATE DATE

2024-11-23T23:03:55.127000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-26246date:2022-04-06T00:00:00
db:CNNVDid:CNNVD-202203-1849date:2022-03-28T00:00:00
db:NVDid:CVE-2022-25439date:2024-11-21T06:52:11.203

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-26246date:2022-04-06T00:00:00
db:CNNVDid:CNNVD-202203-1849date:2022-03-18T00:00:00
db:NVDid:CVE-2022-25439date:2022-03-18T21:15:08.247