PT-2024-3219 · Tenda · Tenda W15E

Wxhwxhwxh_Mie

·

Published

2024-04-17

·

Updated

2025-01-15

·

CVE-2024-4123

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Tenda W15E version 15.11.0.14
Description A critical issue has been found in the function formSetPortMapping of the file /goform/SetPortMapping. The manipulation of the arguments portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal leads to a stack-based buffer overflow. This issue can be exploited remotely, potentially affecting the confidentiality, integrity, and availability of protected information. The exploit has been disclosed to the public.
Recommendations For Tenda W15E version 15.11.0.14, as a temporary workaround, consider disabling the formSetPortMapping function until a patch is available. Restrict access to the /goform/SetPortMapping endpoint to minimize the risk of exploitation. Avoid using the parameters portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-787CWE-121CWE-119

Related Identifiers

BDU:2024-03445
CVE-2024-4123

Affected Products

Tenda W15E