CVE-2022-23918: tcl linkhub mesh wifi Stack-based Buffer Overflow

Vulnerability summary

CVE-2022-23918 is a critical (CVSS 9.8) Stack-based Buffer Overflow vulnerability in tcl linkhub mesh wifi. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-08-2022
   PublishedVulnerability first disclosed.
2. 15-04-2025
   Last modifiedVulnerability information updated.

Description

A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability leverages the ethAddr field within the protobuf message to cause a buffer overflow.

• CWE-121Stack-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the stack.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.