PT-2024-10186 · Tenda · Tenda Ac18

Published 2024-12-28 · Updated 2025-01-18 · CVE-2024-57580

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC18 version V15.03.05.19

Description The issue is related to a stack overflow vulnerability in the formSetDeviceName function, specifically through the devName parameter. This vulnerability can be exploited by sending a specially crafted POST request, potentially allowing a remote attacker to cause a denial of service. The vulnerability is associated with the lack of input size validation, enabling the copying of input data into a buffer without proper checks.

Recommendations For Tenda AC18 version V15.03.05.19, consider disabling the formSetDeviceName function until a patch is available to prevent exploitation. Restrict access to the vulnerable function to minimize the risk of denial of service attacks. Avoid using the devName parameter in affected API endpoints until the issue is resolved.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

BDU:2025-00513

CVE-2024-57580

Affected Products

Tenda Ac18

References · 5

• 🔥 https://github.com/qijiale/Tenda/tree/main/7 · Exploit
• https://osv.dev/vulnerability/CVE-2024-57580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57580 · Security Note
• https://bdu.fstec.ru/vul/2025-00513 · Security Note
• https://twitter.com/CVEnew/status/1880625674765107604 · Twitter Post