Stack-Based Buffer Overflow in Tenda AC6 Router's Device Name Setting Function

CVE-2024-10698

Summary

A serious vulnerability has been detected in the Tenda AC6 router, specifically in the function responsible for setting the device name, located within the /goform/SetOnlineDevName file. This flaw arises from a stack-based buffer overflow, which can be triggered by manipulating the devName argument. This vulnerability is particularly alarming as it can be exploited remotely, allowing an attacker to execute arbitrary code and potentially take control of the device. Users of the affected version, v15.03.05.19, should take immediate steps to secure their network, as the details of this exploit have been publicly disclosed and could be leveraged for attacks.

References