CVE-2023-50990
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A buffer overflow vulnerability was discovered in the Tenda i29 device version V1.0.0.5 in the rebootTime parameter of the sysScheduleRebootSet function.
Risk Assessment
An attacker can remotely crash the device or gain unauthorized access, leading to network disruption and potential data loss.
Recommendation
Immediately update the Tenda i29 firmware to the latest version if a patch is available, or restrict access to the management interface to trusted networks only.
Other vulnerabilities in Tenda i29
See all- CVE-2023-50992Critical
A stack overflow vulnerability was discovered in the Tenda i29 device version V1.0.0.5 in the setPing function via the ip parameter. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2023-50989Critical
A command injection vulnerability was discovered in the Tenda i29 device version V1.0.0.5 within the pingSet function. An attacker can remotely execute arbitrary system commands.
- CVE-2023-50988Critical
A buffer overflow vulnerability was discovered in the Tenda i29 v1.0 V1.0.0.5 device within the wifiRadioSetIndoor function via the bandwidth parameter. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2023-50987Critical
A buffer overflow vulnerability was discovered in the Tenda i29 device version V1.0.0.5 in the sysTimeInfoSet function via the time parameter. An attacker can exploit this flaw to execute arbitrary code remotely or cause a system crash.
- CVE-2023-50986Critical
A buffer overflow vulnerability was discovered in the Tenda i29 device version V1.0.0.5, specifically in the sysLogin function via the time parameter. An attacker can send a crafted request to cause a system crash or potentially execute arbitrary code.
- CVE-2023-50985Critical
A buffer overflow vulnerability was discovered in the Tenda i29 router version V1.0.0.5 in the lanCfgSet function via the lanGw parameter. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2023-50984Critical
A buffer overflow vulnerability was discovered in the Tenda i29 device version V1.0.0.5 in the spdtstConfigAndStart function via the ip parameter. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2023-50983Critical
A command injection vulnerability was discovered in the Tenda i29 v1.0 V1.0.0.5 device within the sysScheduleRebootSet function. An attacker can remotely execute arbitrary system commands.
Original NVD description (English source)
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function.