Stack-Based Buffer Overflow in Tenda AC15 Router
CVE-2024-10662
Key Information:
Badges
Summary
A critical vulnerability exists in the Tenda AC15 router, specifically in the formSetDeviceName function located within the /goform/SetOnlineDevName script. This security flaw allows for a stack-based buffer overflow due to inadequate input validation of the devName parameter. An attacker can exploit this vulnerability remotely, allowing them to potentially execute arbitrary code or disrupt the operation of the device. It is essential for users of the affected router model to apply the necessary security patches and updates to mitigate the risk of exploitation. For more detailed analysis and technical specifications, please refer to the security advisory links provided.
Affected Version(s)
AC15 15.03.05.19
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved