Stack Buffer Overflow in Tenda-AX3 Router
CVE-2021-46394

9.8CRITICAL

Key Information:

Vendor

Tenda
Status
Ax3 Firmware
Vendor
CVE Published:
4 March 2022

What is CVE-2021-46394?

A stack buffer overflow vulnerability exists in the formSetPPTPServer function of Tenda-AX3 routers. The vulnerability arises when the function processes the 'startIp' parameter from an HTTP request without proper input validation. By exploiting this flaw, an attacker can manipulate the stack memory, allowing for potential remote code execution if they carefully construct the input data. This vulnerability underscores the importance of secure coding practices in router firmware to prevent unauthorized access and control.

References

https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/4
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-46394 : Stack Buffer Overflow in Tenda-AX3 Router