Stack-based Buffer Overflow Vulnerability in Tenda AC7

CVE-2024-2903

What is CVE-2024-2903?

A stack-based buffer overflow vulnerability has been identified in the Tenda AC7 router, specifically affecting the GetParentControlInfo function located in the file /goform/GetParentControlInfo. This vulnerability arises from inadequate handling of the MAC argument, which can be manipulated to execute a stack-based overflow. Exploitation can be carried out remotely, allowing potential attackers to compromise the router's functionality and gain unauthorized access. The vulnerability has been publicly disclosed, and its exploit has been documented. Despite prior outreach to the vendor regarding this issue, there has yet to be a response, raising concerns about the potential impact on users of the affected product.

References