Stack-Based Buffer Overflow in Tenda AC18 Router

CVE-2024-2488

What is CVE-2024-2488?

A critical vulnerability exists in the Tenda AC18 router specifically in the function formSetPPTPServer of the file /goform/SetPptpServerCfg. This vulnerability arises from improper handling of the startIP argument, which can lead to a stack-based buffer overflow. Attackers can exploit this vulnerability remotely, allowing them to potentially manipulate device operation and gain unauthorized access. The vulnerability has been publicly disclosed, and it is crucial for users to update their devices to mitigate potential threats. The vendor was contacted regarding this vulnerability but has not provided a response, increasing the urgency for users to take action.

References