PT-2024-5117 · Tenda · Tenda Ax1803
Wxhwxhwxh_Mie
·
Published
2024-04-07
·
Updated
2024-06-04
·
CVE-2024-4236
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Tenda AX1803 version 1.0.0.1
Description:
A critical issue has been found in the function
formSetSysToolDDNS of the file /goform/SetDDNSCfg. The manipulation of the arguments serverName, ddnsUser, ddnsPwd, ddnsDomain leads to a stack-based buffer overflow. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used.Recommendations:
For Tenda AX1803 version 1.0.0.1, as a temporary workaround, consider disabling the
formSetSysToolDDNS function until a patch is available. Restrict access to the /goform/SetDDNSCfg file to minimize the risk of exploitation. Avoid using the arguments serverName, ddnsUser, ddnsPwd, ddnsDomain in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tenda Ax1803