PT-2024-8701 · Tenda · Tenda Ac6

Theraz0R

·

Published

2024-08-09

·

Updated

2024-11-04

·

CVE-2024-10698

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Tenda AC6 version 15.03.05.19
Description A critical issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName, where the manipulation of the argument devName leads to a stack-based buffer overflow. This can be exploited remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The issue is related to the handling of parameters mac and devName, which can cause the operation to exceed the buffer boundaries in memory.
Recommendations For Tenda AC6 version 15.03.05.19, as a temporary workaround, consider disabling the formSetDeviceName function until a patch is available. Restrict access to the /goform/SetOnlineDevName file to minimize the risk of exploitation. Avoid using the parameter devName in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787CWE-121

Related Identifiers

BDU:2024-10303
CVE-2024-10698

Affected Products

Tenda Ac6