Tenda W9 httpd setWrlBasicInfo stack-based overflow
CVE-2024-0537

8.8HIGH

Key Information:

Vendor: Tenda
Status: W9
Vendor: CVE Published:; 15 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Tenda W9 device has been identified to contain a vulnerability within the httpd component, specifically in the setWrlBasicInfo function. An attack vector exists that allows for remote manipulation of the ssidIndex argument, which can trigger a stack-based buffer overflow. This vulnerability facilitates potential unauthorized access and control over the device, raising significant concerns regarding the integrity and security of networks utilizing the Tenda W9 model. As of now, the vendor has been notified about this security issue but has not provided any public acknowledgment or response.

Affected Version(s)

W9 1.0.0.7(4456)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-0537 - Proof of Concept