PT-2024-9129 · Tenda · Tenda Rx9+1
Guoxb
·
Published
2024-10-23
·
Updated
2024-11-01
·
CVE-2024-10283
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Tenda RX9 and RX9 Pro version 22.03.02.20
Description:
A critical issue has been found, affecting the function
sub 4337EC of the file /goform/SetNetControlList. The manipulation of the list argument leads to a stack-based buffer overflow. This can be exploited remotely, potentially allowing an attacker to cause a denial of service by sending a specially crafted POST request to the /goform/SetNetControlList endpoint.Recommendations:
For Tenda RX9 and RX9 Pro version 22.03.02.20, as a temporary workaround, consider disabling the
sub 4337EC function until a patch is available. Restrict access to the /goform/SetNetControlList endpoint to minimize the risk of exploitation. Avoid using the list argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tenda Rx9
Tenda Rx9 Pro