CVE-2020-22079

high-risk

Published 2021-10-29

Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg.

Do I need to act?

6.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (3)

Ac10U Firmware

Ac9 Firmware

Affected Vendors

Tendacn

References (6)

Technical Description https://cwe.mitre.org/data/definitions/121.html

Broken Link https://github.com/1sd3d/Tendown/tree/master/PoCs/Auth/bof11

Exploit https://github.com/Lyc-heng/routers/blob/main/routers/stack1.md

Technical Description https://cwe.mitre.org/data/definitions/121.html

Broken Link https://github.com/1sd3d/Tendown/tree/master/PoCs/Auth/bof11

Exploit https://github.com/Lyc-heng/routers/blob/main/routers/stack1.md

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 9/34 · Low

Exposure 9/34 · Low