Stack-based Buffer Overflow in Tenda AC15 Router

CVE-2024-2850

What is CVE-2024-2850?

A significant vulnerability exists in the Tenda AC15 router, specifically in the 'saveParentControlInfo' function located in the '/goform/saveParentControlInfo' endpoint. This security flaw arises from improper handling of input parameters, leading to a stack-based buffer overflow when maliciously crafted URLs are submitted. This vulnerability allows attackers to exploit the device remotely, contributing to a potential compromise of the router's functionality and security settings. Immediate action is advised to mitigate associated risks, as the exploit has been made public and can be utilized by attackers. Users are urged to update their firmware to mitigate this potential threat.

References