CVE-2023-40042
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
The TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in the setStaticDhcpConfig function in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability and to monitor MQTT traffic for potential attacks.
Original NVD description (English source)
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.