PT-2024-2878 · Tenda · Tenda Ac500

Yhryhryhr_Tu · Published 2024-04-10 · Updated 2025-01-17 · CVE-2024-3908

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC500 version 2.0.1.9(1307)

Description The issue is related to the function formWriteFacMac of the /goform/WriteFacMac file, where the manipulation of the mac parameter can lead to command injection. This can be exploited remotely, allowing an attacker to execute arbitrary code. The vendor was contacted about this disclosure but did not respond.

Recommendations For Tenda AC500 version 2.0.1.9(1307), as a temporary workaround, consider disabling the formWriteFacMac function until a patch is available. Restrict access to the /goform/WriteFacMac endpoint to minimize the risk of exploitation. Avoid using the mac parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-03042

CVE-2024-3908

Affected Products

Tenda Ac500

References · 9

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formWriteFacMac.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3908 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3908 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03042 · Security Note
• https://t.me/cvenotify/77068 · Telegram Post
• https://vuldb.com/?ctiid.261144 · Note
• https://twitter.com/CVEnew/status/1780651931695808830 · Twitter Post
• https://vuldb.com/?id.261144 · Note
• https://vuldb.com/?submit.313803 · Note