PT-2023-27975 · Tenda · Tenda Ac7+1

CVE-2023-41557 · Publicado 2023-08-30 · Atualizado 2023-08-31

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC7 version 1.0 V15.03.06.44 Tenda AC5 version 1.0RTL V15.03.06.28

Description A stack overflow issue was discovered via parameter entrys and mitInterface at the "/goform/addressNat" API endpoint.

Recommendations For Tenda AC7 version 1.0 V15.03.06.44, avoid using the parameter entrys in the affected API endpoint until the issue is resolved. For Tenda AC5 version 1.0RTL V15.03.06.28, restrict access to the mitInterface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2023-41557

Produtos afetados

Tenda Ac5

Tenda Ac7

Referências · 5

• 🔥 https://github.com/peris-navince/founded-0-days/blob/main/fromAddressNat/1.md · Exploit
• https://t.me/cibsecurity/69427 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-41557 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-41557 · Nota de Segurança
• https://twitter.com/CVEnew/status/1696868686705967165 · Publicação no Twitter