Tenda AC10U formSetDeviceName stack-based overflow
CVE-2024-0923

9.8CRITICAL

Key Information:

Vendor: Tenda
Status: AC10U
Vendor: CVE Published:; 26 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A stack-based buffer overflow vulnerability has been identified in the Tenda AC10U routers specifically in the function formSetDeviceName. The vulnerability allows an attacker to manipulate the devName argument, potentially leading to unauthorized access and exploitation. This could facilitate remote attacks with significant consequences for device integrity and user data security. Despite early disclosures to the vendor, Tenda has not responded, raising concerns about the security posture for users of the affected devices. Immediate attention to this security issue is recommended to mitigate risks.

Affected Version(s)

AC10U 15.03.06.49_multi_TDE01

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-0923 - Proof of Concept