CVE-2022-45661 is a high-severity buffer overflow vulnerability identified in the Tenda AC6V1.0 router firmware version 15.03.05.19. The flaw exists in the setSmartPowerManagement function, specifically triggered via the 'time' parameter. Buffer overflow vulnerabilities, classified under CWE-120, occur when a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory. In this case, the improper handling of the 'time' parameter input allows an attacker to overflow the buffer, which can lead to denial of service (DoS) conditions by crashing the device or potentially enable remote code execution if exploited further. The CVSS 3.1 base score of 7.5 reflects a high severity level, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The impact is limited to availability (A:H), with no direct confidentiality or integrity impact reported. This means an unauthenticated attacker can remotely trigger the vulnerability over the network without any user interaction, causing the device to become unavailable. The vulnerability affects a specific firmware version of the Tenda AC6 router, a consumer-grade networking device commonly used for home and small office internet connectivity. No patches or official vendor advisories are currently available, and no known exploits have been reported in the wild as of the publication date. Given the nature of the vulnerability, exploitation could disrupt network connectivity for affected users, impacting business operations or home internet access. The lack of authentication requirement and network accessibility make this vulnerability particularly concerning for exposed devices.

For European organizations, the primary impact of CVE-2022-45661 is the potential disruption of network infrastructure due to router unavailability. Organizations relying on Tenda AC6 routers for critical connectivity may experience denial of service, leading to loss of internet access, interruption of business communications, and potential cascading effects on dependent services. While the vulnerability does not directly compromise confidentiality or integrity, the availability impact can be significant, especially for small and medium enterprises (SMEs) or remote offices that may lack redundant network paths. Additionally, if attackers develop advanced exploits leveraging this buffer overflow for remote code execution, the risk profile could escalate, potentially allowing attackers to gain control over the router, intercept traffic, or pivot into internal networks. The absence of patches increases the window of exposure. European organizations with limited IT security resources or those using consumer-grade networking equipment are particularly vulnerable. Furthermore, sectors with high reliance on stable internet connectivity, such as finance, healthcare, and critical infrastructure, could face operational risks if affected devices are deployed within their networks.

1. Immediate Network Segmentation: Isolate Tenda AC6 routers from critical network segments to limit exposure. Place them behind firewalls or VPNs restricting inbound access to management interfaces. 2. Disable Remote Management: If remote management features are enabled on the affected routers, disable them to reduce attack surface. 3. Monitor Network Traffic: Implement network monitoring to detect unusual traffic patterns or repeated requests targeting the setSmartPowerManagement function or related endpoints. 4. Firmware Updates: Regularly check Tenda’s official channels for firmware updates or security advisories addressing this vulnerability. Although no patch is currently available, timely application of updates once released is critical. 5. Device Replacement: For organizations unable to mitigate risk through configuration changes, consider replacing affected Tenda AC6 routers with devices from vendors with stronger security track records and active patch management. 6. Vendor Engagement: Engage with Tenda support to request information on planned patches and timelines. 7. Incident Response Preparedness: Prepare incident response plans to quickly address potential denial of service or compromise scenarios involving these routers. 8. Network Access Controls: Employ access control lists (ACLs) to restrict which internal hosts can communicate with the router’s management interfaces, minimizing exposure to internal threats.