Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflow

CVE-2024-0992

Summary

A security vulnerability has been identified in the Tenda i6 router, where the function formwrlSSIDset located in the /goform/wifiSSIDset path is susceptible to stack-based buffer overflow. This flaw allows for manipulation of the argument index, potentially enabling remote attackers to execute arbitrary code. The vulnerability has been publicly disclosed, and exploitation attempts may be ongoing. Despite early notifications to Tenda regarding this issue, the vendor has not provided a response, raising concerns about the urgency for users to secure their devices.

References