Stack-Based Buffer Overflow Vulnerability in Tenda AC18 Router
CVE-2024-2485

8.8HIGH

Key Information:

Vendor: Tenda
Status: Ac18
Vendor: CVE Published:; 15 March 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A significant vulnerability has been discovered in the Tenda AC18 router, specifically within the 'formSetSpeedWan' function utilized in the '/goform/SetSpeedWan' file. This vulnerability can be exploited via a stack-based buffer overflow triggered by manipulating the 'speed_dir' argument. As the attack can be executed remotely, its potential for widespread exploitation raises alarms. The vulnerability has already been disclosed publicly, with no response from the vendor despite early notification. Users of the affected version 15.03.05.05 are strongly advised to assess their security measures and potential exposure.

Affected Version(s)

AC18 15.03.05.05

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-2485 - Proof of Concept