Tenda · Tenda Ac18 · CVE-2024-2487
**Name of the Vulnerable Software and Affected Versions**
Tenda AC18 version 15.03.05.05
**Description**
A critical issue affects the `formSetDeviceName` function of the `/goform/SetOnlineDevName` file, leading to a stack-based buffer overflow when the `devName` or `mac` argument is manipulated. This can be exploited remotely, potentially impacting the confidentiality, integrity, and availability of protected information. The exploit has been publicly disclosed.
**Recommendations**
For Tenda AC18 version 15.03.05.05, as a temporary workaround, consider disabling the `formSetDeviceName` function until a patch is available. Restrict access to the `/goform/SetOnlineDevName` file to minimize the risk of exploitation. Avoid using the `devName` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.