CVE-2022-24010

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24009

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24008

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24008

The CVE-2022-24008 entry affects TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14 (confcli) and describes a buffer overflow in GetValue. Talos details show GetValue ultimately calls cfms_mib_proc_handle with a fixed 4th argument, and GetValue’s wrapper can copy data into a very small destination buffer, e...

CVE-2022-24007

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24007

TALOS reports a buffer-overflow vulnerability in TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14 caused by GetValue handling of flash config data. GetValue uses cfms_mib_proc_handle/GetCfmValue with a small 0x10-byte destination buffer, while the retrieved value can be up to 0x5dc bytes, enabling an over...

CVE-2022-24006

A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all...

CVE-2022-24006

CVE-2022-24006 describes a buffer overflow in the GetValue functionality of TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14, specifically in the arpbrocast binary. The root cause is a mismatch between the output buffer size (destination buffer on the stack) and the data retrieved via GetValue/GetCfmValue...

CVE-2022-24005

TCL LinkHub Mesh Wi‑Fi (MS1G_00_01.00_14) vulnerability CVE-2022-24005: GetValue in ap_steer path copies data without buffer size check, enabling a stack-based buffer overflow and potential arbitrary code execution via flash configuration values. Talos analysis details the flow: GetValue→cfms_mib...

CVE-2022-23919

The CVE-2022-23919 entry concerns TCL LinkHub Mesh Wifi MS1G_00_01.00_14. Talos reports a stack-based buffer overflow in the confsrv set_mf_rule handling of protobuf-based messages received over the device API (ProtoBuffer on port 9003). During parsing, memcpy uses a length derived from untrusted...

CVE-2022-23919

A stack-based buffer overflow vulnerability exists in the confsrv setmfrule functionality of TCL LinkHub Mesh Wifi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability...

CVE-2022-23918

A stack-based buffer overflow vulnerability exists in the confsrv setmfrule functionality of TCL LinkHub Mesh Wifi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability...

CVE-2022-23918

CVE-2022-23918 is a stack-based buffer overflow in TCL LinkHub Mesh Wifi MS1G_00_01.00_14, specifically in confsrv set_mf_rule. Talos details show that during protobuf processing, the code copies ethAddr (and name) into small stack buffers using memcpy with length based on strlen, enabling overfl...

CVE-2022-23399

Mode C: The CVE-2022-23399 issue affects TCL LinkHub Mesh Wifi MS1G_00_01.00_14. TALOS-2022-1454 documents a stack-based buffer overflow in confsrv set_port_fwd_rule. A Protobuffer PortFwdList is unpacked and then passed to set_port_fwd_rule; within this function a local 0x80-byte buffer (var_88)...

CVE-2022-23103

A stack-based buffer overflow vulnerability exists in the confsrv confctlsetapplanguage functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2022-23103

The CVE-2022-23103 issue affects TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14. TALOS-2022-1462 shows a stack-based buffer overflow in confsrv_confctl_set_app_language. The vulnerability arises when the protobuffer APPLang.lang is unpacked and copied with strcpy into a fixed-size stack buffer without p...

CVE-2022-22144

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

CVE-2022-22140

An os command injection vulnerability exists in the confsrv ucloudaddnode functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2022-22140

An os command injection vulnerability exists in the confsrv ucloudaddnode functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2022-22140

CVE-2022-22140 is a confirmed OS command injection affecting TCL LinkHub Mesh Wi‑Fi MS1G_00_01.00_14. The vulnerability occurs in confsrv ucloud_add_node, where ProtoBuffer data is parsed and the serialNum field is passed directly to doSystemCmd, resulting in arbitrary command execution via syste...