Security readout for executives and security teams
Plain-English summary
This CVE describes a critical buffer overflow in Tenda i21 firmware V1.0.0.14(4656) through the SNMP settings web path. A network attacker may be able to crash the device or compromise it if the vulnerable interface is reachable. The sources do not name a vendor patch or confirmed exploitation.
Executive priority
Prioritize this as critical if Tenda i21 devices are deployed, especially if remotely managed. The business risk is potential device compromise or outage, but current evidence does not prove active exploitation or identify a confirmed patch.
Technical view
The record identifies CWE-787 out-of-bounds write in /goform/setSnmpInfo on Tenda i21 V1.0.0.14(4656). CVSS 3.1 is 9.8 with network attack vector, low complexity, no privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where Tenda i21 devices running V1.0.0.14(4656) have their web management interface reachable from untrusted networks. The provided structured affected-product fields are incomplete, so validation should rely on device inventory and firmware checks.
Exploitation context
The bundle includes a public researcher reference, but no CISA KEV listing and no cited source confirming active in-the-wild exploitation. Treat internet-reachable management interfaces as urgent because the CVSS vector indicates unauthenticated remote attack potential.
Researcher notes
The public data is sparse: title, description, CVSS vector, CWE-787, and one GitHub researcher reference. The affected-product metadata is marked n/a despite the description naming Tenda i21 V1.0.0.14(4656), so confirm device lineage before broad conclusions.
Mitigation direction
- Identify and isolate any Tenda i21 devices running V1.0.0.14(4656).
- Remove internet exposure for device management interfaces immediately.
- Restrict administration to trusted networks or VPN paths only.
- Check Tenda support channels for fixed firmware or official mitigation guidance.
- Disable unnecessary SNMP or related management features where supported.
Validation and detection
- Inventory Tenda i21 access points and record exact firmware versions.
- Confirm whether management interfaces are reachable from untrusted networks.
- Review perimeter rules for access to device administration services.
- Check configuration for unnecessary SNMP management exposure.
- Monitor affected devices for crashes, resets, or unexpected configuration changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-44363 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.