Stack-Based Buffer Overflow Vulnerability in Tenda AC10
CVE-2024-2856

8.8HIGH

Key Information:

Vendor: Tenda
Status: Ac10
Vendor: CVE Published:; 24 March 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A critical stack-based buffer overflow vulnerability has been identified in the Tenda AC10 router, specifically in the fromSetSysTime function located at /goform/SetSysTimeCfg. This vulnerability arises from improper handling of the timeZone argument, allowing remote attackers to leverage this flaw to execute arbitrary code on affected systems. The affected versions include Tenda AC10 firmware versions 16.03.10.13 and 16.03.10.20. This exploit poses significant risks as it enables the potential takeover of the device, threatening both individual users and broader network security. Despite multiple attempts to communicate this issue to Tenda, no response has been received, highlighting the urgency for users to assess the security measures of their affected devices.

Affected Version(s)

AC10 16.03.10.13

AC10 16.03.10.20

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-2856 - Proof of Concept

CVE-2024-2856-Stack-overflow-EXP
Created by Schnaidr