Stack-Based Buffer Overflow Vulnerability in Tenda AC7 Router

CVE-2024-2893

Summary

A recently identified security vulnerability in the Tenda AC7 router, specifically in the formSetDeviceName function located in the /goform/SetOnlineDevName file, poses a significant threat. This vulnerability involves a stack-based buffer overflow triggered by the manipulation of the devName argument, enabling potential attackers to execute arbitrary code or disrupt device operations. The threat can be exploited remotely, posing an immediate risk to users. The vulnerability has been publicly disclosed, highlighting the urgent need for affected users to take action. Despite early notifications to the vendor, no responsive measures have been communicated. It is crucial for users to assess their devices and update to secure versions or apply necessary mitigations.

References