Null Pointer Dereference Vulnerability in Tenda Routers

CVE-2024-10280

Summary

A vulnerability has been identified in various models of Tenda AC series routers, compromising the functionality of the websReadEvent within the /goform/GetIPTV module. The flaw lies in the manipulation of the Content-Length argument, which can lead to null pointer dereference, potentially allowing remote attackers to exploit the issue. This vulnerability affects Tenda models AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500, and AC1206, up to a specific version. The public disclosure of this exploit raises significant security concerns for users of affected products.

References