Duojie_0X00

**Name of the Vulnerable Software and Affected Versions** Tenda DAP-1520 version 1.10B04 BETA02 **Description** A critical issue was found, affecting the `check dws cookie` function of the file /storage. This issue leads to a stack-based buffer overflow. The attack can be launched remotely. **Recommendations** For Tenda DAP-1520 version 1.10B04 BETA02, as a temporary workaround, consider disabling the `check dws cookie` function until a patch is available. Restrict access to the /storage file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda DAP-1520 version 1.10B04 BETA02 **Description** A critical issue has been found, affecting the `set ws action` function of the `/dws/api/` file, leading to a heap-based buffer overflow. This can be initiated remotely. **Recommendations** For Tenda DAP-1520 version 1.10B04 BETA02, as a temporary workaround, consider disabling the `set ws action` function until a patch is available. Restrict access to the `/dws/api/` endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda DAP-1520 version 1.10B04 BETA02 **Description** A critical vulnerability has been found, affecting the `mod graph auth uri handler` function of the Authentication Handler component. This issue leads to a stack-based buffer overflow and can be initiated remotely. The exploit has been disclosed to the public. **Recommendations** For Tenda DAP-1520 version 1.10B04 BETA02, consider disabling the `mod graph auth uri handler` function as a temporary workaround until a patch is available. Restrict access to the Authentication Handler component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda RX3 version 16.03.13.11 multi **Description** A critical issue affects the processing of the file /goform/telnet, leading to command injection. The attack may be initiated remotely. **Recommendations** For Tenda RX3 version 16.03.13.11 multi, as a temporary workaround, consider disabling access to the /goform/telnet file until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.