PT-2023-4242 · Tenda · Tenda Ac8+4
Published
2023-07-03
·
Updated
2023-08-10
·
CVE-2023-38935
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Tenda AC1206 version 15.03.06.23
Tenda AC8 V4 version 16.03.34.06
Tenda AC5 V1 version 15.03.06.28
Tenda AC10 version 4.0 V16.03.10.13
Tenda AC9 version 3.0 V15.03.06.42 multi
Description
The issue is related to a buffer overflow in the
formSetQosBand function when processing the list parameter. This can allow a remote attacker to execute arbitrary code or cause a denial of service.Recommendations
For Tenda AC1206 version 15.03.06.23, consider disabling the
formSetQosBand function until a patch is available.
For Tenda AC8 V4 version 16.03.34.06, restrict access to the formSetQosBand function to minimize the risk of exploitation.
For Tenda AC5 V1 version 15.03.06.28, avoid using the list parameter in the affected function until the issue is resolved.
For Tenda AC10 version 4.0 V16.03.10.13, consider applying configuration changes to limit the impact of the buffer overflow.
For Tenda AC9 version 3.0 V15.03.06.42 multi, as a temporary workaround, consider disabling the formSetQosBand function until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Stack Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tenda Ac10
Tenda Ac1206
Tenda Ac5
Tenda Ac8
Tenda Ac9