PT-2023-8314 · Tenda · Tenda W9

Gd@Hillstone · Published 2023-12-26 · Updated 2023-12-30 · CVE-2023-51101

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda W9 version 1.0.0.7(4456) CN

Description The issue is related to a stack overflow vulnerability in the formSetUplinkInfo function of the Tenda W9 wireless access point's firmware, allowing an attacker to execute arbitrary code remotely by exploiting the buffer overflow in memory.

Recommendations For Tenda W9 version 1.0.0.7(4456) CN, consider disabling the formSetUplinkInfo function as a temporary workaround until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-00428

CVE-2023-51101

Affected Products

Tenda W9

References · 8

• 🔥 https://github.com/GD008/TENDA/blob/main/W9/W9_setUplinkInfo/W9_setUplinkInfo.md · Exploit
• https://bdu.fstec.ru/vul/2024-00428 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-51101 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51101 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2024-01-12.1.pdf · Security Note
• https://twitter.com/VulmonFeeds/status/1739734742449242555 · Twitter Post
• https://twitter.com/CVEnew/status/1739702125142159434 · Twitter Post
• https://vuldb.com/?id.249058 · Note