CVE-2022-35559

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 parameters and ping2 parameters for a stack overflow attack. An attacker can use this vulnerability to execute arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/formSetAutoPingExploit, Third Party Advisory
https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/formSetAutoPingExploit, Third Party Advisory

Timeline

Published: Aug 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-35564.8The Cab fare calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vehicle title setting in versions up to, a CVE-2022-355607.5A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to caus CVE-2022-355617.5A stack overflow vulnerability exists in /goform/WifiMacFilterSet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to CVE-2022-355694.8Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows CVE-2022-355727.5On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /Sys CVE-2022-35588.0The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.CVE-2022-355828.8Penta Security Systems Inc WAPPLES 4.0.*, 5.0.0.*, 5.0.12.* are vulnerable to Incorrect Access Control. The operating system that WAPPLES ru CVE-2022-355839.8wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag wit CVE-2022-355854.8A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Par CVE-2022-355874.8A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Paramete CVE-2022-355894.8A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Paramete CVE-2022-35597.5A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler.