Stack-Based Buffer Overflow in Tenda AC15 Cookie Handler

CVE-2024-2815

Summary

A critical vulnerability has been identified in the Tenda AC15 router, specifically within the R7WebsSecurityHandler function found in the Cookie Handler component. This issue arises from improper handling of input parameters, which leads to a stack-based buffer overflow when the password argument is manipulated. This flaw can be exploited remotely, putting the device and connected networks at risk of unauthorized access and control. It is important for users and administrators of the affected Tenda AC15 version 15.03.20_multi to take precautionary measures to mitigate potential threats. The vendor has been informed of this exploitation risk but has not provided a response or a fix as of yet.

References