Security readout for executives and security teams
Plain-English summary
This CVE concerns specific Tenda router firmware where a web management parameter can trigger a stack overflow. The sources do not provide CVSS, confirmed exploitation, vendor patch details, or business impact. Treat exposed or unsupported affected routers as a practical network-edge risk until vendor guidance is confirmed.
Executive priority
Prioritize discovery and exposure reduction for affected routers at network edges. Urgency is constrained by missing severity and exploitation evidence, but router management flaws can become high-impact when exposed remotely.
Technical view
CVE-2023-37723 describes a stack overflow in the page parameter handled by the fromqossetting function. The named firmware versions are Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN. No CWE, CVSS vector, patch status, or exploitation evidence is provided in the supplied sources.
Likely exposure
Exposure is limited to environments running the named Tenda F1202 or FH1202 firmware versions, especially if router administration interfaces are reachable beyond trusted management networks.
Exploitation context
The supplied CVE data and reference report identify the vulnerable parameter and function, but do not show CISA KEV listing, confirmed in-the-wild exploitation, or reliable public exploitation status.
Researcher notes
The source bundle is sparse: it names the vulnerable function and parameter but lacks CVSS, CWE, patch, authentication context, and exploit maturity. Validation should focus on asset/version matching and safe exposure review, not production exploitation.
Mitigation direction
- Inventory Tenda F1202 and FH1202 routers and record exact firmware versions.
- Check Tenda or device supplier guidance for fixed firmware or replacement advice.
- Restrict router administration access to trusted management networks only.
- Remove any public internet exposure of router management interfaces.
- Retire unsupported affected devices if no vendor fix is available.
Validation and detection
- Compare firmware banners or admin UI versions against the affected versions.
- Confirm management interfaces are not reachable from the public internet.
- Review configuration for remote administration exposure.
- Check vendor advisories before assuming a patch exists.
- Monitor edge-device logs for unexpected administrative access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-37723 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/fromqossetting/report.mdCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.