PT-2024-6435 · Tenda · Tenda O1

Wxhwxhwxh_Tutu

·

Published

2024-08-27

·

Updated

2024-08-31

·

CVE-2024-8226

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Tenda O1 version 1.0.0.7(10648)
Description A critical vulnerability has been found in the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to a stack-based buffer overflow. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond.
Recommendations As a temporary workaround, consider disabling the formSetCfm function in the /goform/setcfm file until a patch is available. Restrict access to the /goform/setcfm endpoint to minimize the risk of exploitation. Avoid using the funcpara1 argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787CWE-121

Related Identifiers

BDU:2024-07520
CVE-2024-8226

Affected Products

Tenda O1