CVE-2022-43106: Tenda AC23 Router Stack Overflow Vulnerability in setSchedWifi Function - Exploit Details, Affected Models, and Mitigation Measures

A new vulnerability has been discovered in Tenda AC23 routers, specifically in the firmware version V16.03.07.45_cn. This vulnerability, given the identifier CVE-2022-43106, leads to a stack overflow due to improper validation of the schedStartTime parameter in the setSchedWifi function. Attackers exploiting this vulnerability could potentially obtain arbitrary code execution capabilities and compromise a victim's router. In this post, we will dive into the details of this exploit, discuss the affected devices, and provide recommendations for mitigation.

Background

Tenda AC23 is a popular dual-band gigabit wireless router, providing fast and stable internet connections for various devices. The vulnerability in question has been identified in Tenda AC23 routers using the firmware version V16.03.07.45_cn. It is important to understand the risks associated with this vulnerability and take the necessary steps to protect your devices.

Vulnerability Details

CVE-2022-43106 refers to a stack overflow vulnerability present in the setSchedWifi function of the affected Tenda AC23 router firmware. The stack overflow occurs because the router fails to correctly validate and handle the schedStartTime parameter, which is a user-controlled input. An attacker can leverage this vulnerability to execute arbitrary code on the victim's router, leading to a potential compromise of the device and its network.

Here's a code snippet that showcases the parsing and handling of the schedStartTime parameter

int setSchedWifi(char* schedStartTime) {
    char buffer[48];

    // ... other code ...

    memcpy(buffer, schedStartTime, strlen(schedStartTime));

    // ... rest of the function ...
}

This memcpy function call can lead to the stack overflow. By supplying a large input to this function via the schedStartTime parameter, an attacker can overwrite critical data structures on the stack and gain control over the execution flow of the router's firmware.

Original References

More details about this vulnerability can be found in the following security advisories and documents:

1. CVE-2022-43106 Details - National Vulnerability Database (NVD)
2. Tenda AC23 Router vulnerability report by the security researcher who discovered the issue

Affected Models

The following Tenda AC23 router models with firmware version V16.03.07.45_cn are known to be affected by this vulnerability:

To address this vulnerability, users should take the following steps

1. Update Your Firmware: Tenda has released a firmware update that addresses this issue. It is essential to update your router's firmware to the latest version. This can be done through the router's web interface or by visiting Tenda's official website to download the latest firmware.

2. Monitor Incoming Traffic: It is vital to closely monitor your router's incoming traffic to detect any unusual or malicious activity. If you notice any suspicious activity on your network, consider disconnecting your router from the internet and seeking assistance from a security professional.

3. Disable Remote Management: If not required, consider disabling remote management features on your router to prevent unauthorized access. This can be done through the settings menu of your router's interface.

4. Change Default Login Credentials: Always change the default login credentials for your router as soon as you purchase and install the device. Doing so will minimize the chances of an attacker gaining unauthorized access to your network.

Conclusion

In conclusion, the stack overflow vulnerability identified as CVE-2022-43106 in Tenda AC23 routers with firmware version V16.03.07.45_cn is a serious security threat that should not be overlooked. Taking necessary steps to update your router's firmware, monitor network traffic, disable remote management features, and change default login credentials will significantly mitigate the potential risks associated with this exploit. Stay vigilant and stay secure!

Timeline

Published on: 11/03/2022 14:15:00 UTC
Last modified on: 11/03/2022 17:28:00 UTC