PT-2023-9692 · Tenda · Tenda Ax1806

Anza2001 · Published 2023-11-03 · Updated 2024-10-28 · CVE-2023-47455

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AX1806 version 1.0.0.1

Description The issue is related to a heap overflow in the setSchedWifi function. This occurs because the src and v12 variables are directly obtained from HTTP request parameters schedStartTime and schedEndTime without checking their size. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For Tenda AX1806 version 1.0.0.1, as a temporary workaround, consider disabling the setSchedWifi function until a patch is available. Restrict access to the schedStartTime and schedEndTime parameters in the affected HTTP endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-10181

CVE-2023-47455

Affected Products

Tenda Ax1806

References · 6

• 🔥 https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1806/setSchedWifi.md · Exploit
• https://bdu.fstec.ru/vul/2024-10181 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47455 · Security Note
• https://t.me/cvenotify/99802 · Telegram Post
• https://t.me/cvenotify/93351 · Telegram Post