First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2022-47127

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://brief-nymphea-813.notion.site/Vul11-A15-bof-WifiBasicSet-wrlPwd-de8dbe64e48f4981a6f0f5216622b6d9Exploit, Third Party Advisory
https://brief-nymphea-813.notion.site/Vul11-A15-bof-WifiBasicSet-wrlPwd-de8dbe64e48f4981a6f0f5216622b6d9Exploit, Third Party Advisory

Timeline

Published: Dec 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-471289.8Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.CVE-2022-471299.8PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.CVE-2022-471304.3A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with admin CVE-2022-471314.8A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.CVE-2022-471328.8A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.CVE-2022-471348.8Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.CVE-2022-471358.8Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.CVE-2022-471368.8Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 ver CVE-2022-471374.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPManageNinja LLC Ninja Tables plugin <= 4.3.4 versions.CVE-2022-471388.8Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.CVE-2022-471398.8Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.CVE-2022-47145.4The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a