logo
DATABASE RESOURCES PRICING ABOUT US

Siretta QUARTZ-GOLD DetranCLI command parsing stack-based buffer overflow vulnerabilities

2023-01-26T00:00:00

Description

# Talos Vulnerability Report ### TALOS-2022-1613 ## Siretta QUARTZ-GOLD DetranCLI command parsing stack-based buffer overflow vulnerabilities ##### January 26, 2023 ##### CVE Number CVE-2022-40992,CVE-2022-41018,CVE-2022-41005,CVE-2022-41028,CVE-2022-40990,CVE-2022-40985,CVE-2022-40989,CVE-2022-40991,CVE-2022-40994,CVE-2022-41002,CVE-2022-41012,CVE-2022-41019,CVE-2022-41030,CVE-2022-41011,CVE-2022-41027,CVE-2022-40986,CVE-2022-41007,CVE-2022-41022,CVE-2022-41020,CVE-2022-40995,CVE-2022-40998,CVE-2022-41001,CVE-2022-41006,CVE-2022-41014,CVE-2022-41029,CVE-2022-41010,CVE-2022-40997,CVE-2022-40996,CVE-2022-41016,CVE-2022-40988,CVE-2022-41017,CVE-2022-41004,CVE-2022-41013,CVE-2022-41000,CVE-2022-40999,CVE-2022-41025,CVE-2022-41008,CVE-2022-41015,CVE-2022-41026,CVE-2022-41024,CVE-2022-41009,CVE-2022-41003,CVE-2022-40993,CVE-2022-41021,CVE-2022-40987,CVE-2022-41023 ##### SUMMARY Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities. ##### CONFIRMED VULNERABLE VERSIONS The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor. Siretta QUARTZ-GOLD G5.0.1.5-210720-141020 ##### PRODUCT URLS QUARTZ-GOLD - <https://www.siretta.com/products/industrial-routers/4g-lte-router/gigabit-ethernet-small-footprint-lte-router-eu/> ##### CVSSv3 SCORE 7.2 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H ##### CWE CWE-120 - Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) ##### DETAILS The Siretta QUARTZ-GOLD is an industrial cellular router with several features and services, such as: SSH, UPNP, VPN, SNMP and many others. The QUARTZ-GOLD router offers a customized router console by the `DetranCLI` binary. From this CLI interface, it is possible to use several functionalities. Many functionalities have a parsing pattern that is vulnerable to stack-based buffer overflow. This pattern looks like: `sprintf(stack_buffer, format_string, command_parameter_1, ...)`. The problem is that, in many functions, the `command_parameter_X`’s size is not checked to take into account the size of `stack_buffer`, which can lead to stack-based buffer overflow. The `DetranCLI` binary uses command template for each command. Following the relevant template special keyword: * `WORD` This is a parameter with any sequence of printable characters * `CODE` This parameter is similar to `WORD` * `A.B.C.D` This parameter represents an IP address * `<min_value-max_value>` This is a numerical parameter with a range of possible values, from `min_value` to `max_value` * `(choice1|choice2....)` This is a parameter with a set of possible values. The value can be another special keyword, like `WORD` or `<min_value-max_value>` Each of the above special keyword is going to fill the `char**` array provided as second parameter on each command function. From this point this second argument parameter will be called `argv`. Each special keyword will be inserted in `argv` progressively. For example, for the command: firmwall keyword WORD description (WORD|null) This function will have as `argv[0]` a sequence of character, and as `argv[1]` either any sequence of characters or the string ‘null’. Following is the list of vulnerable commands with its details. #### CVE-2022-40985 - ddnsX hostname This stack-based buffer overflow can be reached using the following command template: (ddns1|ddns2) hostname WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x200,"%s<%s:%s<%s<%s<%s<%s<%s","","","",argv[1],"0","","0",""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40986 - ddnsX mx This stack-based buffer overflow can be reached using the following command template: (ddns1|ddns2) mx WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x200,"%s<%s:%s<%s<%s<%s<%s<%s","","","","","0",argv[1],"0",""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40987 - ddnsX username This stack-based buffer overflow can be reached using the following command template: (ddns1|ddns2) username WORD password CODE If the command is issued correctly, the following code will be reached: sprintf(buff_0x200,"%s<%s:%s<%s<%s<%s<%s<%s","",argv[1],argv[2],"","0","","0",""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40988 - ipv6 static dns This stack-based buffer overflow can be reached using the following command template: ipv6 static dns WORD WORD WORD If the command is issued correctly, the following code will be reached: sprintf(buff_260,"%s %s %s",*argv,argv[1],argv[2]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40989 - bandwidth This stack-based buffer overflow can be reached using the following command template: bandwidth WORD dlrate <1-9999> dlceil <1-9999> ulrate <1-9999> ulceil <1-9999> priority (highest|high|normal|low|lowest) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%s<%s<%s<%s<%s<%d<0<0",*argv,argv[1],argv[2],argv[3],argv[4],based_on_argv[5]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40990 - no bandwidth This stack-based buffer overflow can be reached using the following command template: no bandwidth WORD dlrate <1-9999> dlceil <1-9999> ulrate <1-9999> ulceil <1-9999> priority (highest|high|normal|low|lowest) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%s<%s<%s<%s<%s<%d<0<0",*argv,argv[1],argv[2],argv[3],argv[4],based_on_argv[5]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40991 - firmwall domain This stack-based buffer overflow can be reached using the following command template: firmwall domain WORD description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s",1,*argv,argv[1]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40992 - no firmwall domain This stack-based buffer overflow can be reached using the following command template: no firmwall domain WORD description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(stack_0x80,"%d<%s<%s",1,*argv,argv[1]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40993 - firmwall keyword This stack-based buffer overflow can be reached using the following command template: firmwall keyword WORD description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s",1,*argv,argv[1]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40994 - no firmwall keyword This stack-based buffer overflow can be reached using the following command template: no firmwall keyword WORD description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s",1,*argv,argv[1]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40995 - firmwall srcmac This stack-based buffer overflow can be reached using the following command template: firmwall srcmac (WORD|null) srcip (A.B.C.D|null) dstip (A.B.C.D|null) protocol (none|tcp|udp|icmp) srcport (<1-65535>|null) dstport (<1-65535>|null) policy (drop|accept) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%s<%s<%d<%s<%s<%d<%s>",1,*argv,argv[1],argv[2],depentent_on_argv[3],argv[4],argv[5],iVar6,argv[7]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40996 - no firmwall srcmac This stack-based buffer overflow can be reached using the following command template: no firmwall srcmac (WORD|null) srcip (A.B.C.D|null) dstip (A.B.C.D|null) protocol (none|tcp|udp|icmp) srcport (<1-65535>|null) dstport (<1-65535>|null) policy (drop|accept) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%s<%s<%d<%s<%s<%d<%s",1,*argv,argv[1],argv[2],depentent_on_argv[3],argv[4],argv[5],depentent_on_argv[6],argv[7]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40997 - gre index This stack-based buffer overflow can be reached using the following command template: gre index <1-8> destination A.B.C.D/M description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s<%s>",1,*argv,argv[1],argv[2]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40998 - no gre index This stack-based buffer overflow can be reached using the following command template: no gre index <1-8> destination A.B.C.D/M description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s<%s",1,*argv,argv[1],argv[2]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-40999 - gre index with keepalive This stack-based buffer overflow can be reached using the following command template: gre index <1-8> tunnel A.B.C.D source (A.B.C.D|null) dest A.B.C.D keepalive (on|off) interval (<0-255>|null) retry (<0-255>|null) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s<%s<%s<%d<%s<%s<%s>",1,*argv,argv[1],argv[2],argv[3],dependent_on_argv[4],argv[5],argv[6],argv[7]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41000 - no gre index with keepalive This stack-based buffer overflow can be reached using the following command template: no gre index <1-8> tunnel A.B.C.D source (A.B.C.D|null) dest A.B.C.D keepalive (on|off) interval (<0-255>|null) retry (<0-255>|null) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s<%s<%s<%d<%s<%s<%s",1,*argv,argv[1],argv[2],argv[3],dependent_on_argv[4],argv[5],argv[6],argv[7]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41001 - icmp check link This stack-based buffer overflow can be reached using the following command template: icmp check link WORD destination WORD interval <1-255> retries <1-255> description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s<%d<%d<%s",1,*argv,argv[1],atoi_argv_2,atoi_argv[3],argv[4]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41002 - no icmp check link This stack-based buffer overflow can be reached using the following command template: no icmp check link WORD destination WORD interval <1-255> retries <1-255> description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%s<%s<%d<%d<%s",1,*argv,argv[1],atoi_argv[2],atoi_argv[3],argv[4]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41003 - ip nat outside source This stack-based buffer overflow can be reached using the following command template: ip nat outside source (udp|tcp|all) (WORD|null) WORD to A.B.C.D (WORD|null) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%d<%s<%s<%s<%s<%s",1,based_on_argv[0],argv[1],argv[2],argv[4],argv[3],argv[5]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41004 - no ip nat outside source This stack-based buffer overflow can be reached using the following command template: no ip nat outside source (udp|tcp|all) (WORD|null) WORD to A.B.C.D (WORD|null) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x40,"%d<%d<%s<%s<%s<%s<%s",1,based_on_argv[0],argv[1],argv[2],argv[4],argv[3],argv[5]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41005 - ip static route This stack-based buffer overflow can be reached using the following command template: ip static route destination A.B.C.D gateway A.B.C.D mask A.B.C.D metric <0-10> interface (lan|wan|vpn) description WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%s<%s<%s<%s<%s<%s",*argv,argv[1],argv[2],argv[3],argv[4],argv[5]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41006 - no ip static route This stack-based buffer overflow can be reached using the following command template: no ip static route destination A.B.C.D gateway A.B.C.D mask A.B.C.D metric <0-10> interface (lan|wan|vpn) description WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%s<%s<%s<%s<%s<%s",*argv,argv[1],argv[2],argv[3],argv[4],argv[5]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41007 - port redirect protocol This stack-based buffer overflow can be reached using the following command template: port redirect protocol (tcp|udp|tcp/udp) inport <1-65535> dstaddr A.B.C.D export <1-65535> description WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%d<%s<%s<%s<%s>",1,based_on_argv[0],atoi_argv[1],argv[2],atoi_argv[3],argv[4]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41008 - no port redirect protocol This stack-based buffer overflow can be reached using the following command template: no port redirect protocol (tcp|udp|tcp/udp) inport <1-65535> dstaddr A.B.C.D export <1-65535> description WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%d<%s<%s<%s<%s",1,based_on_argv[0],atoi_argv[1],argv[2],atoi_argv[3],argv[4]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41009 - port triger protocol This stack-based buffer overflow can be reached using the following command template: port triger protocol (tcp|udp|tcp/udp) triger port <1-65535> forward port <1-65535> description WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%d<%s<%s<%s>",1,based_on_argv[0],atoi_argv[1],atoi_argv[2],argv[3]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41010 - no port triger protocol This stack-based buffer overflow can be reached using the following command template: no port triger protocol (tcp|udp|tcp/udp) triger port <1-65535> forward port <1-65535> description WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x80,"%d<%d<%s<%s<%s",1,based_on_argv[0],atoi_argv[1],atoi_argv[2],argv[3]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41011 - schedule link1 This stack-based buffer overflow can be reached using the following command template: schedule link1 WORD link2 WORD policy (failover|backup) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%s<%d<%s",1,*argv,argv[1],dependent_on_argv[2],argv[3]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41012 - no schedule link1 This stack-based buffer overflow can be reached using the following command template: no schedule link1 WORD link2 WORD policy (failover|backup) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%s<%d<%s",1,*argv,argv[1],dependent_on_argv[2],argv[3]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41013 - static dhcp mac This stack-based buffer overflow can be reached using the following command template: static dhcp mac WORD (WORD|null) ip A.B.C.D hostname (WORD|null) description (WORD|null) If the command is issued correctly, the following code will be reached: if (*argv[1] == '\x00'){ format_string = "%s%s<%s<%s<%s"; } else{ format_string = "%s,%s<%s<%s<%s"; } sprintf(buff_0x40,format_string,*argv,argv[1],argv[2],argv[3],argv[4]); #### CVE-2022-41014 - no static dhcp mac This stack-based buffer overflow can be reached using the following command template: no static dhcp mac WORD (WORD|null) ip A.B.C.D hostname (WORD|null) description (WORD|null) If the command is issued correctly, the following code will be reached: if (*argv[1] == '\x00'){ format_string = "%s%s<%s<%s<%s"; } else{ format_string = "%s,%s<%s<%s<%s"; } sprintf(buff_0x40,format_string,*argv,argv[1],argv[2],argv[3],argv[4]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41015 - vpn basic protocol This stack-based buffer overflow can be reached using the following command template: vpn basic protocol (l2tp|pptp) name WORD server WORD username WORD passsword WORD firmwall (on|off) defroute (on|off) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%d<%s<%s<%s<%s<%d<%d<%s",1,based_on_argv[0],argv[1],argv[2],argv[3],argv[4],based_on_argv[5],based_on_argv[6],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41016 - no vpn basic protocol This stack-based buffer overflow can be reached using the following command template: no vpn basic protocol (l2tp|pptp) name WORD server WORD username WORD passsword WORD firmwall (on|off) defroute (on|off) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%d<%s<%s<%s<%s<%d<%d<%s",1,based_on_argv[0],argv[1],argv[2],argv[3],argv[4],based_on_argv[5],based_on_argv[6],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41017 - vpn basic protocol with localip This stack-based buffer overflow can be reached using the following command template: vpn basic protocol (l2tp|pptp) name WORD server WORD username WORD passsword WORD firmwall (on|off) defroute (on|off) localip A.B.C.D If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%d<%s<%s<%s<%s<%d<%d<%s",1,based_on_argv[0],argv[1],argv[2],argv[3],argv[4],based_on_argv[5],based_on_argv[6],argv[7]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41018 - no vpn basic protocol with localip This stack-based buffer overflow can be reached using the following command template: no vpn basic protocol (l2tp|pptp) name WORD server WORD username WORD passsword WORD firmwall (on|off) defroute (on|off) localip A.B.C.D If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%d<%s<%s<%s<%s<%d<%d<%s",1,based_on_argv[0],argv[1],argv[2],argv[3],argv[4],based_on_argv[5],based_on_argv[6],argv[7]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41019 - vpn l2tp advanced name This stack-based buffer overflow can be reached using the following command template: vpn l2tp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> auth (on|off) password (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%s<%s",1,*argv,based_on_argv[1],argv[2],argv[3],based_on_argv[4],argv[5],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41020 - no vpn l2tp advanced name This stack-based buffer overflow can be reached using the following command template: no vpn l2tp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> auth (on|off) password (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%s<%s",1,*argv,based_on_argv[1],argv[2],argv[3],based_on_argv[4],argv[5],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41021 - vpn l2tp advanced name with options This stack-based buffer overflow can be reached using the following command template: vpn l2tp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> auth (on|off) password (WORD|null) options WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%s<%s",1,*argv,based_on_argv[1],atoi_argv[2],argv[3],based_on_argv[4],argv[5],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41022 - no vpn l2tp advanced name with options This stack-based buffer overflow can be reached using the following command template: no vpn l2tp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> auth (on|off) password (WORD|null) options WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%s<%s",1,*argv,based_on_argv[1],atoi_argv[2],argv[3],based_on_argv[4],argv[5],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41023 - vpn pptp advanced name This stack-based buffer overflow can be reached using the following command template: vpn pptp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> mppe (on|off) stateful (on|off) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%d<%s",1,*argv,based_on_argv[1],argv[2],argv[3],based_on_argv[4],based_on_argv[5],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41024 - no vpn pptp advanced name This stack-based buffer overflow can be reached using the following command template: no vpn pptp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> mppe (on|off) stateful (on|off) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%d<%s",1,*argv,based_on_argv[1],argv[2],argv[3],based_on_argv[4],based_on_argv[5],""); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41025 - vpn pptp advanced name with options This stack-based buffer overflow can be reached using the following command template: vpn pptp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> mppe (on|off) stateful (on|off) options WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%d<%s",1,*argv,based_on_argv[1],argv[2],argv[3],based_on_argv[4],based_on_argv[5],argv[6]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41026 - no vpn pptp advanced name with options This stack-based buffer overflow can be reached using the following command template: no vpn pptp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> mppe (on|off) stateful (on|off) options WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%d<%s<%s<%d<%d<%s",1,*argv,based_on_argv[1],argv[2],argv[3],based_on_argv[4],based_on_argv[5],argv[6]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41027 - vpn schedule name1 This stack-based buffer overflow can be reached using the following command template: vpn schedule name1 WORD name2 WORD policy (failover|backup) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%s<%d<%s",1,*argv,argv[1],based_on_argv[2],argv[3]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41028 - no vpn schedule name1 This stack-based buffer overflow can be reached using the following command template: no vpn schedule name1 WORD name2 WORD policy (failover|backup) description (WORD|null) If the command is issued correctly, the following code will be reached: sprintf(buff_0x100,"%d<%s<%s<%d<%s",1,*argv,argv[1],based_on_argv[2],argv[3]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41029 - wlan filter mac address This stack-based buffer overflow can be reached using the following command template: wlan filter mac address WORD descript WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x20,"%s%s%s%s%s%s<%s",octet_from_argv0[0],octet_from_argv0[1],octet_from_argv0[2],octet_from_argv0[3],octet_from_argv0[4],octet_from_argv0[5],argv[1]); The function executing this code is vulnerable to a stack-based buffer overflow. #### CVE-2022-41030 - no wlan filter mac address This stack-based buffer overflow can be reached using the following command template: no wlan filter mac address WORD descript WORD If the command is issued correctly, the following code will be reached: sprintf(buff_0x20,"%s%s%s%s%s%s<%s",octet_from_argv0[0],octet_from_argv0[1],octet_from_argv0[2],octet_from_argv0[3],octet_from_argv0[4],octet_from_argv0[5],argv[1]); The function executing this code is vulnerable to a stack-based buffer overflow. ##### TIMELINE 2022-10-14 - Initial Vendor Contact 2022-10-20 - Vendor Disclosure 2022-11-24 - Vendor Patch Release 2023-01-26 - Public Release ##### Credit Discovered by Francesco Benvenuto of Cisco Talos. * * * Vulnerability Reports Next Report TALOS-2022-1639 Previous Report TALOS-2022-1612


Related


prion
NVD

CVE-2022-41004

2023-01-26T22:15:00
prion
NVD

CVE-2022-41022

2023-01-26T22:15:00
prion
NVD

CVE-2022-41019

2023-01-26T22:15:00
prion
NVD

CVE-2022-41007

2023-01-26T22:15:00
prion
NVD

CVE-2022-41018

2023-01-26T22:15:00
prion
NVD

CVE-2022-41008

2023-01-26T22:15:00
prion
NVD

CVE-2022-40997

2023-01-26T22:15:00
prion
NVD

CVE-2022-41014

2023-01-26T22:15:00
prion
NVD

CVE-2022-41013

2023-01-26T22:15:00
prion
NVD

CVE-2022-40987

2023-01-26T22:15:00
prion
NVD

CVE-2022-41020

2023-01-26T22:15:00
prion
NVD

CVE-2022-41016

2023-01-26T22:15:00
prion
NVD

CVE-2022-41027

2023-01-26T22:15:00
prion
NVD

CVE-2022-41006

2023-01-26T22:15:00
prion
NVD

CVE-2022-40992

2023-01-26T22:15:00
prion
NVD

CVE-2022-41012

2023-01-26T22:15:00
prion
NVD

CVE-2022-40996

2023-01-26T22:15:00
prion
NVD

CVE-2022-40993

2023-01-26T22:15:00
prion
NVD

CVE-2022-40999

2023-01-26T22:15:00
prion
NVD

CVE-2022-40998

2023-01-26T22:15:00
prion
NVD

CVE-2022-41002

2023-01-26T22:15:00
prion
NVD

CVE-2022-41009

2023-01-26T22:15:00
prion
NVD

CVE-2022-41015

2023-01-26T22:15:00
prion
NVD

CVE-2022-41025

2023-01-26T22:15:00
prion
NVD

CVE-2022-41028

2023-01-26T22:15:00
prion
NVD

CVE-2022-40988

2023-01-26T22:15:00
prion
NVD

CVE-2022-41010

2023-01-26T22:15:00
prion
NVD

CVE-2022-40990

2023-01-26T22:15:00
prion
NVD

CVE-2022-41024

2023-01-26T22:15:00
prion
NVD

CVE-2022-41017

2023-01-26T22:15:00
prion
NVD

CVE-2022-40991

2023-01-26T22:15:00
prion
NVD

CVE-2022-40995

2023-01-26T22:15:00
prion
NVD

CVE-2022-41003

2023-01-26T22:15:00
prion
NVD

CVE-2022-41011

2023-01-26T22:15:00
prion
NVD

CVE-2022-40994

2023-01-26T22:15:00
prion
NVD

CVE-2022-40985

2023-01-26T22:15:00
prion
NVD

CVE-2022-41030

2023-01-26T22:15:00
prion
NVD

CVE-2022-41005

2023-01-26T22:15:00
prion
NVD

CVE-2022-41001

2023-01-26T22:15:00
prion
NVD

CVE-2022-41023

2023-01-26T22:15:00
prion
NVD

CVE-2022-40986

2023-01-26T22:15:00
prion
NVD

CVE-2022-41026

2023-01-26T22:15:00
prion
NVD

CVE-2022-41000

2023-01-26T22:15:00
prion
NVD

CVE-2022-41021

2023-01-26T22:15:00
prion
NVD

CVE-2022-40989

2023-01-26T22:15:00
prion
NVD

CVE-2022-41029

2023-01-26T22:15:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17035)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17029)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17044)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17073)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD buffer overflow vulnerability

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17043)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17062)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17041)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17030)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17063)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17066)

2023-02-01T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17037)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17070)

2023-02-01T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17072)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17042)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17069)

2023-02-01T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17027)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17036)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17068)

2023-02-01T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17034)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17026)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-16880)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17031)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17085)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17088)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17033)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-15943)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17038)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17091)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-16878)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17039)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17067)

2023-02-01T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17028)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-16877)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17025)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17040)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-16881)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17032)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17086)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17071)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17089)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-15942)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17087)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17090)

2023-01-30T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-15941)

2023-02-09T00:00:00
cnvd
cnvd

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-16876)

2023-02-09T00:00:00
cve
NVD

CVE-2022-40988

2023-01-26T22:15:00
cve
NVD

CVE-2022-40990

2023-01-26T22:15:00
cve
NVD

CVE-2022-41014

2023-01-26T22:15:00
cve
NVD

CVE-2022-40992

2023-01-26T22:15:00
cve
NVD

CVE-2022-41005

2023-01-26T22:15:00
cve
NVD

CVE-2022-41023

2023-01-26T22:15:00
cve
NVD

CVE-2022-41026

2023-01-26T22:15:00
cve
NVD

CVE-2022-41012

2023-01-26T22:15:00
cve
NVD

CVE-2022-41008

2023-01-26T22:15:00
cve
NVD

CVE-2022-41009

2023-01-26T22:15:00
cve
NVD

CVE-2022-41011

2023-01-26T22:15:00
cve
NVD

CVE-2022-40994

2023-01-26T22:15:00
cve
NVD

CVE-2022-40995

2023-01-26T22:15:00
cve
NVD

CVE-2022-41006

2023-01-26T22:15:00
cve
NVD

CVE-2022-40993

2023-01-26T22:15:00
cve
NVD

CVE-2022-41013

2023-01-26T22:15:00
cve
NVD

CVE-2022-41007

2023-01-26T22:15:00
cve
NVD

CVE-2022-41000

2023-01-26T22:15:00
cve
NVD

CVE-2022-40987

2023-01-26T22:15:00
cve
NVD

CVE-2022-40996

2023-01-26T22:15:00
cve
NVD

CVE-2022-41029

2023-01-26T22:15:00
cve
NVD

CVE-2022-40998

2023-01-26T22:15:00
cve
NVD

CVE-2022-41019

2023-01-26T22:15:00
cve
NVD

CVE-2022-41002

2023-01-26T22:15:00
cve
NVD

CVE-2022-41025

2023-01-26T22:15:00
cve
NVD

CVE-2022-41010

2023-01-26T22:15:00
cve
NVD

CVE-2022-41004

2023-01-26T22:15:00
cve
NVD

CVE-2022-40991

2023-01-26T22:15:00
cve
NVD

CVE-2022-41015

2023-01-26T22:15:00
cve
NVD

CVE-2022-41022

2023-01-26T22:15:00
cve
NVD

CVE-2022-41003

2023-01-26T22:15:00
cve
NVD

CVE-2022-41030

2023-01-26T22:15:00
cve
NVD

CVE-2022-41016

2023-01-26T22:15:00
cve
NVD

CVE-2022-40997

2023-01-26T22:15:00
cve
NVD

CVE-2022-41018

2023-01-26T22:15:00
cve
NVD

CVE-2022-41001

2023-01-26T22:15:00
cve
NVD

CVE-2022-41020

2023-01-26T22:15:00
cve
NVD

CVE-2022-40999

2023-01-26T22:15:00
cve
NVD

CVE-2022-40986

2023-01-26T22:15:00
cve
NVD

CVE-2022-41027

2023-01-26T22:15:00
cve
NVD

CVE-2022-41017

2023-01-26T22:15:00
cve
NVD

CVE-2022-41021

2023-01-26T22:15:00
cve
NVD

CVE-2022-41024

2023-01-26T22:15:00
cve
NVD

CVE-2022-40989

2023-01-26T22:15:00
cve
NVD

CVE-2022-40985

2023-01-26T22:15:00
cve
NVD

CVE-2022-41028

2023-01-26T22:15:00
talosblog
blog

Vulnerability Spotlight: OS command injection, directory traversal and other vulnerabilities found in Siretta Quartz-Gold and FreshTomato

2023-01-26T21:26:14
talosblog
blog

The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter

2023-08-02T12:00:19