CVE-2022-24006

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24006

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24006

CVE-2022-24006 describes a buffer overflow in the GetValue functionality of TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14, specifically in the arpbrocast binary. The root cause is a mismatch between the output buffer size (destination buffer on the stack) and the data retrieved via GetValue/GetCfmValue...

CVE-2022-24005

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24005

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24005

TCL LinkHub Mesh Wi‑Fi (MS1G_00_01.00_14) vulnerability CVE-2022-24005: GetValue in ap_steer path copies data without buffer size check, enabling a stack-based buffer overflow and potential arbitrary code execution via flash configuration values. Talos analysis details the flow: GetValue→cfms_mib...

CVE-2022-23919

The CVE-2022-23919 entry concerns TCL LinkHub Mesh Wifi MS1G_00_01.00_14. Talos reports a stack-based buffer overflow in the confsrv set_mf_rule handling of protobuf-based messages received over the device API (ProtoBuffer on port 9003). During parsing, memcpy uses a length derived from untrusted...

CVE-2022-23919

A stack-based buffer overflow vulnerability exists in the confsrv setmfrule functionality of TCL LinkHub Mesh Wifi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability...

CVE-2022-23918

A stack-based buffer overflow vulnerability exists in the confsrv setmfrule functionality of TCL LinkHub Mesh Wifi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability...

CVE-2022-23918

A stack-based buffer overflow vulnerability exists in the confsrv setmfrule functionality of TCL LinkHub Mesh Wifi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability...

CVE-2022-23918

CVE-2022-23918 is a stack-based buffer overflow in TCL LinkHub Mesh Wifi MS1G_00_01.00_14, specifically in confsrv set_mf_rule. Talos details show that during protobuf processing, the code copies ethAddr (and name) into small stack buffers using memcpy with length based on strlen, enabling overfl...

CVE-2022-23399

Mode C: The CVE-2022-23399 issue affects TCL LinkHub Mesh Wifi MS1G_00_01.00_14. TALOS-2022-1454 documents a stack-based buffer overflow in confsrv set_port_fwd_rule. A Protobuffer PortFwdList is unpacked and then passed to set_port_fwd_rule; within this function a local 0x80-byte buffer (var_88)...

CVE-2022-23399

A stack-based buffer overflow vulnerability exists in the confsrv setportfwdrule functionality of TCL LinkHub Mesh Wifi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2022-23103

The CVE-2022-23103 issue affects TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14. TALOS-2022-1462 shows a stack-based buffer overflow in confsrv_confctl_set_app_language. The vulnerability arises when the protobuffer APPLang.lang is unpacked and copied with strcpy into a fixed-size stack buffer without p...

CVE-2022-23103

A stack-based buffer overflow vulnerability exists in the confsrv confctlsetapplanguage functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2022-23103

A stack-based buffer overflow vulnerability exists in the confsrv confctlsetapplanguage functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2022-22144

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

CVE-2022-22144

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

CVE-2022-22144

CVE-2022-22144 affects the TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14. During boot, libcommonprod’s prod_change_root_passwd is invoked unconditionally, forcing the root password to the value “tcl-wifi” and enabling full root access without any user action. Talos confirms the vulnerability details an...

CVE-2022-22140

CVE-2022-22140 is a confirmed OS command injection affecting TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14. The vulnerability occurs in confsrv ucloud_add_node, where ProtoBuffer data is parsed and the serialNum field is passed directly to doSystemCmd, resulting in arbitrary command execution via syste...