Tenda W9 httpd formWifiMacFilterGet stack-based overflow
CVE-2024-0542

9.8CRITICAL

Key Information:

Vendor: Tenda
Status: W9
Vendor: CVE Published:; 15 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A stack-based buffer overflow vulnerability exists in the Tenda W9, specifically within the formWifiMacFilterGet function of the httpd component. This vulnerability arises due to improper handling of the argument index, enabling attackers to potentially execute arbitrary code remotely. The exploit has been publicly disclosed, increasing the urgency for users to secure their devices. Despite attempts to contact the vendor for mitigating actions, there has been no response. Users are advised to remain vigilant and consider implementing security best practices to protect their devices.

Affected Version(s)

W9 1.0.0.7(4456)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-0542 - Proof of Concept