PT-2024-3253 · Tenda · Tenda I21

Yhryhryhr_Miemie · Published 2024-04-27 · Updated 2024-06-04 · CVE-2024-4493

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda i21 version 1.0.0.14(4656)

Description A critical vulnerability was found in the Tenda i21, affecting the formSetAutoPing function. The manipulation of the ping1/ping2 argument leads to a stack-based buffer overflow. This issue can be exploited remotely, potentially impacting the confidentiality, integrity, and availability of protected information. The exploit has been disclosed publicly. The vendor was contacted about this disclosure but did not respond.

Recommendations As a temporary workaround, consider disabling the formSetAutoPing function until a patch is available. Restrict access to the ping1 and ping2 parameters in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2024-03484

CVE-2024-4493

Affected Products

Tenda I21

References · 11

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formSetAutoPing.md · Exploit
• https://bdu.fstec.ru/vul/2024-03484 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4493 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4493 · Vendor Advisory
• https://vuldb.com/?submit.323602 · Note
• https://vuldb.com/?id.263082 · Note
• https://twitter.com/CVEnew/status/1787139414075773281 · Twitter Post
• https://vuldb.com/?ctiid.263082 · Note
• https://twitter.com/VulmonFeeds/status/1786994693366046727 · Twitter Post
• https://twitter.com/linuxpatch/status/1786970474037010928 · Twitter Post
• https://t.me/cvenotify/79133 · Telegram Post