Stack-Based Buffer Overflow Vulnerability in Tenda AC10U Router

CVE-2024-2703

Summary

A significant vulnerability has been identified in the Tenda AC10U router, specifically within the 'formSetDeviceName' function located at '/goform/SetOnlineDevName'. This vulnerability arises from a stack-based buffer overflow caused by improper handling of the 'mac' argument, which can be exploited remotely. Malicious actors could leverage this flaw to execute arbitrary code on the device, potentially compromising the security of the network. As of now, the vulnerability is publicly disclosed and poses a serious risk, particularly since the vendor has not responded to prior communications regarding this issue. Users of affected devices should take immediate steps to mitigate potential exploitation.

References