PT-2024-10240 · Tenda · Tenda Ac18

Published 2024-12-28 · Updated 2025-01-18 · CVE-2024-57578

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19

Description The issue is related to a stack overflow in the formSetCfm() function due to the funcpara1 parameter. This can potentially allow a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability is associated with a buffer overflow when processing the funcpara1 parameter.

Recommendations For Tenda AC18 version 15.03.05.19, consider disabling the formSetCfm() function until a patch is available to prevent potential exploitation. Restrict access to the vulnerable function to minimize the risk of arbitrary code execution or denial of service. Avoid using the funcpara1 parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-121

CWE-120

Related Identifiers

BDU:2025-00620

CVE-2024-57578

Affected Products

Tenda Ac18

References · 5

• 🔥 https://github.com/qijiale/Tenda/blob/main/5/Readme.md · Exploit
• https://bdu.fstec.ru/vul/2025-00620 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57578 · Security Note
• https://twitter.com/CVEnew/status/1880625673024508052 · Twitter Post