Stack-based Buffer Overflow in Tenda AC10U Router

CVE-2024-2763

Summary

A serious vulnerability has been identified in the Tenda AC10U router, specifically within the formSetCfm function inside the goform/setcfm file. This issue arises due to a stack-based buffer overflow that can be triggered by manipulating the funcpara1 argument. The vulnerability allows an attacker to execute arbitrary code remotely, potentially compromising the device without the need for local access. Despite being disclosed to the vendor prior to public announcement, Tenda has not responded to these concerns. Organizations using the affected version are strongly advised to evaluate their security posture and apply necessary updates or mitigations to mitigate potential risks.

References