Buffer Overflow Vulnerability in Tenda AC7, AC9, and AC10 Router Systems

CVE-2018-14559

Summary

A buffer overflow vulnerability has been identified within the web server of Tenda AC7, AC9, and AC10 routers. This issue arises when the web server improperly handles list parameters in post requests, allowing an attacker to exploit the vulnerable sprintf function. By supplying malicious input, the attacker can overwrite the function's return address stored on the stack, potentially leading to arbitrary code execution and compromising the device's integrity. Users are advised to update their firmware to the latest version to mitigate this security risk.

References