Buffer Overflow Vulnerability in Tenda AC8 Router
CVE-2024-4065

8.8HIGH

Key Information:

Vendor

Tenda
Status
Ac8
Vendor
CVE Published:
23 April 2024

Badges

👾 Exploit Exists

What is CVE-2024-4065?

A severe buffer overflow vulnerability exists in the Tenda AC8 router's remote management functionality. Specifically, the affected function, formSetRebootTimer, is located in the /goform/SetRebootTimer file. By manipulating the rebootTime parameter, attackers can trigger a stack-based buffer overflow remotely. Exploitation of this vulnerability could lead to unauthorized access and control over the device. Despite early disclosures to the vendor for remediation, there has been no response or mitigation from Tenda, increasing the risk for users. Hacked routers can lead to compromised networks, making timely updates and security assessments critical for device owners.

Affected Version(s)

AC8 16.03.34.09

References

https://vuldb.com/?id.261791
vdb-entrytechnical-description
https://vuldb.com/?ctiid.261791
signaturepermissions-required
https://vuldb.com/?submit.316494
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

yhryhryhr_tu (VulDB User)
.
CVE-2024-4065 : Buffer Overflow Vulnerability in Tenda AC8 Router