PT-2024-6437 · Tenda · Tenda O5

Yhryhryhr_Miemie

·

Published

2024-08-27

·

Updated

2024-08-31

·

CVE-2024-8228

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Tenda O5 version 1.0.0.8(5017)
Description The issue is related to a stack-based buffer overflow in the fromSafeSetMacFilter function of the /goform/setMacFilterList file. This can be exploited remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The manipulation of the remark, type, or time arguments leads to the buffer overflow. The exploit has been disclosed publicly, and the vendor was contacted but did not respond.
Recommendations As a temporary workaround, consider disabling the fromSafeSetMacFilter function until a patch is available. Restrict access to the /goform/setMacFilterList file to minimize the risk of exploitation. Avoid using the remark, type, or time arguments in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787CWE-121

Related Identifiers

BDU:2024-07522
CVE-2024-8228

Affected Products

Tenda O5