Vulnerability · Published Aug 8, 2023 · Assigned by mitre
CVE-2023-40041
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.0%top 36.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.