CVE-2023-44021: tendacn ac10u_firmware

Modified

Published 27-09-2023Last modified 24-09-2024

Vulnerability summary

CVE-2023-44021 is a critical (CVSS 9.8) vulnerability in tendacn ac10u_firmware. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 65.9% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

1.12%

0%100%

Low · +0.21 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

27-09-2023
PublishedVulnerability first disclosed.
24-09-2024
Last modifiedVulnerability information updated.

Description

Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the formSetClientState function.

CVSS metrics

1 score · 1 source · 1 version

v3.19.8

EPSS trend

Probability

1.12%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

Increase +0.21 pp

From 0.91% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Tendacn1 product

ac10u_firmware15.03.06.49_multi_tde01

1 vendor · 1 product

References

1 links

github.com/aixiao0621/Tenda/blob/main/AC10U/2/0.mdThird Party Advisory