CVE-2022-30040

Name of the Vulnerable Software and Affected Versions Tenda AX1803 version 1.0.0.1 2890

Description The issue is related to a Buffer Overflow that can cause a denial of service in the router. It is located in the /goform/setsystimecfg endpoint of the /bin/tdhttpd in the ubif file system. Attackers can access the endpoint via http://ip/goform/SetSysTimeCfg and exploit the ntpserve parameter to trigger a stack buffer overflow.

Recommendations For Tenda AX1803 version 1.0.0.1 2890, as a temporary workaround, consider restricting access to the /goform/setsystimecfg endpoint until a patch is available. Avoid using the ntpserve parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.