PT-2023-27975 · Tenda · Tenda Ac7+1

Published 2023-08-30 · Updated 2023-08-31 · CVE-2023-41557

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC7 version 1.0 V15.03.06.44 Tenda AC5 version 1.0RTL V15.03.06.28

Description A stack overflow issue was discovered via parameter entrys and mitInterface at the "/goform/addressNat" API endpoint.

Recommendations For Tenda AC7 version 1.0 V15.03.06.44, avoid using the parameter entrys in the affected API endpoint until the issue is resolved. For Tenda AC5 version 1.0RTL V15.03.06.28, restrict access to the mitInterface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-41557

Affected Products

Tenda Ac5

Tenda Ac7

References · 5

• 🔥 https://github.com/peris-navince/founded-0-days/blob/main/fromAddressNat/1.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-41557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41557 · Security Note
• https://t.me/cibsecurity/69427 · Telegram Post
• https://twitter.com/CVEnew/status/1696868686705967165 · Twitter Post