Stack-Based Buffer Overflow in Tenda F1202 Router
CVE-2024-3877

8.8HIGH

Key Information:

Vendor

Tenda
Status
F1202
Vendor
CVE Published:
16 April 2024

Badges

👾 Exploit Exists

What is CVE-2024-3877?

A critical vulnerability has been identified in the Tenda F1202 router model, specifically affecting version 1.2.0.20(408). This vulnerability occurs within the fromqossetting function located in the /goform/fromqossetting file. By manipulating the qos argument, an attacker can exploit a stack-based buffer overflow, potentially allowing for unauthorized remote access and control of the device. The vulnerability has been publicly disclosed and could be actively exploited if left unpatched. Despite attempts to notify Tenda regarding this security risk, no response has been received from the vendor to address the issue. It is essential for users of the Tenda F1202 router to take immediate action to mitigate this risk.

Affected Version(s)

F1202 1.2.0.20(408)

References

https://vuldb.com/?id.260911
vdb-entrytechnical-description
https://vuldb.com/?ctiid.260911
signaturepermissions-required
https://vuldb.com/?submit.312820
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

wxhwxhwxh_mie (VulDB User)
.
CVE-2024-3877 : Stack-Based Buffer Overflow in Tenda F1202 Router