Stack-Based Buffer Overflow in Tenda AC18 Router

CVE-2024-2489

Summary

A significant vulnerability has been identified in the Tenda AC18 router, specifically in the formSetQosBand function within the /goform/SetNetControlList file. This flaw allows unauthorized manipulation of argument lists, resulting in a stack-based buffer overflow. This vulnerability can be exploited remotely, posing a substantial security risk to users. Once exploited, malicious actors could execute arbitrary code or disrupt the router's functionality. Given the public disclosure of this vulnerability, it is imperative that users apply the necessary patches or mitigations provided by the vendor to safeguard their devices.

References