Tenda W9 httpd setWrlAccessList stack-based overflow
CVE-2024-0536

9.8CRITICAL

Key Information:

Vendor: Tenda
Status: W9
Vendor: CVE Published:; 15 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability exists in the Tenda W9 1.0.0.7, specifically within the setWrlAccessList function of the httpd component. The issue arises from improper handling of the ssidIndex argument, leading to a stack-based buffer overflow. This weakness allows for potential remote exploitation, enabling attackers to execute arbitrary code. Despite early notification of the vulnerability to the vendor, Tenda did not respond. As the exploit has been publicly disclosed, it poses a significant risk to users of the affected product.

Affected Version(s)

W9 1.0.0.7(4456)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-0536 - Proof of Concept