Stack-Based Buffer Overflow in Tenda AC7 Wireless Router

CVE-2024-2899

Summary

A significant security flaw has been identified in the Tenda AC7 Wireless Router, specifically within the fromSetWirelessRepeat function located in the /goform/WifiExtraSet file. This vulnerability allows manipulation of the wpapsk_crypto argument, leading to a stack-based buffer overflow, which can be exploited remotely. Given the nature of this vulnerability, attackers can potentially execute arbitrary code and gain unauthorized access to the affected system. The public disclosure of this exploit heightens the urgency for users to apply suitable remediation measures. Despite notifications made to Tenda regarding this critical issue, the vendor has not provided any response or patch updates, raising concerns about the security commitment towards its product line.

References