Sign-up

ID

VAR-202312-0938


CVE

CVE-2023-51092


TITLE

Tenda M3 upgrade method buffer overflow vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-06242

DESCRIPTION

Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade. Tenda M3 is an access control controller produced by China Tenda Company. This vulnerability is caused by the upgrade method failing to correctly verify the length of the input data. A remote attacker can use this vulnerability to execute arbitrary code on the system or cause a denial of service. attack

Trust: 1.44

sources: NVD: CVE-2023-51092 // CNVD: CNVD-2024-06242

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-06242

AFFECTED PRODUCTS

vendor:tendamodel:m3scope:eqversion:1.0.0.12\(4856\)

Trust: 1.0

vendor:tendamodel:m3scope:eqversion:v1.0.0.12(4856)

Trust: 0.6

sources: CNVD: CNVD-2024-06242 // NVD: CVE-2023-51092

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-51092
value: CRITICAL

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2023-51092
value: HIGH

Trust: 1.0

CNVD: CNVD-2024-06242
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-06242
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-51092
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2023-51092
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-06242 // NVD: CVE-2023-51092 // NVD: CVE-2023-51092

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

sources: NVD: CVE-2023-51092

PATCH

title:Patch for Tenda M3 upgrade method buffer overflow vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/521216

Trust: 0.6

sources: CNVD: CNVD-2024-06242

EXTERNAL IDS

db:NVDid:CVE-2023-51092

Trust: 1.6

db:CNVDid:CNVD-2024-06242

Trust: 0.6

sources: CNVD: CNVD-2024-06242 // NVD: CVE-2023-51092

REFERENCES

url:https://github.com/gd008/tenda/blob/main/m3/upgrade/m3_upgrade.md

Trust: 1.6

sources: CNVD: CNVD-2024-06242 // NVD: CVE-2023-51092

SOURCES

db:CNVDid:CNVD-2024-06242
db:NVDid:CVE-2023-51092

LAST UPDATE DATE

2024-09-10T23:09:33.901000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-06242date:2024-01-29T00:00:00
db:NVDid:CVE-2023-51092date:2024-09-09T19:35:05.803

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-06242date:2024-01-25T00:00:00
db:NVDid:CVE-2023-51092date:2023-12-26T18:15:08.173