Stack-Based Buffer Overflow in Tenda AC18 Router
CVE-2024-2489

8.8HIGH

Key Information:

Vendor

Tenda
Status
Ac18
Vendor
CVE Published:
15 March 2024

Badges

👾 Exploit Exists

What is CVE-2024-2489?

A significant vulnerability has been identified in the Tenda AC18 router, specifically in the formSetQosBand function within the /goform/SetNetControlList file. This flaw allows unauthorized manipulation of argument lists, resulting in a stack-based buffer overflow. This vulnerability can be exploited remotely, posing a substantial security risk to users. Once exploited, malicious actors could execute arbitrary code or disrupt the router's functionality. Given the public disclosure of this vulnerability, it is imperative that users apply the necessary patches or mitigations provided by the vendor to safeguard their devices.

Affected Version(s)

AC18 15.03.05.05

References

https://vuldb.com/?id.256896
vdb-entrytechnical-description
https://vuldb.com/?ctiid.256896
signaturepermissions-required
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/T...
exploit

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

yhryhryhr (VulDB User)
.
CVE-2024-2489 : Stack-Based Buffer Overflow in Tenda AC18 Router