9.8

CVE-2020-22079

Exploit
Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tendacn ≫ Ac10u Firmware Version15.03.06.48_multi_tde01
   Tendacn ≫ Ac10u Version1.0
Tendacn ≫ Ac9 Firmware Version15.03.05.19(6318)
   Tendacn ≫ Ac9 Version1.0
Tendacn ≫ Ac9 Firmware Version15.03.06.42_multi
   Tendacn ≫ Ac9 Version3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4% 0.892
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://cwe.mitre.org/data/definitions/121.html
Technical Description
https://github.com/1sd3d/Tendown/tree/master/PoCs/Auth/bof11
Broken Link
https://github.com/Lyc-heng/routers/blob/main/routers/stack1.md
Third Party Advisory
Exploit