CVE-2022-30474

Name of the Vulnerable Software and Affected Versions Tenda AC18 versions prior to V15.03.05.19(6318)

Description The issue is related to a heap overflow in the httpd module when handling the /goform/saveParentControlInfo API endpoint, specifically due to the saveParentControlInfo() function's handling of the deviceId parameter. This can allow a remote attacker to cause a denial of service or execute arbitrary code.

Recommendations For Tenda AC18 versions prior to V15.03.05.19(6318), as a temporary workaround, consider disabling the saveParentControlInfo() function until a patch is available. Restrict access to the /goform/saveParentControlInfo API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.