Stack-based Buffer Overflow in Tenda AC8 Router

CVE-2024-4064

Summary

A critical vulnerability exists within the Tenda AC8 router that can be exploited via a stack-based buffer overflow. This security issue arises from improper handling of the 'password' argument in the R7WebsSecurityHandler function located in the /goform/execCommand file. Attackers can initiate a remote exploit, potentially allowing malicious entities to gain unauthorized access or control over the device. Despite early disclosure attempts to the vendor, Tenda has not provided any response or remediation information. Users of the Tenda AC8, particularly those running version 16.03.34.09, are strongly advised to assess their network security and apply any available mitigations to protect against potential exploitation.

References