Buffer Overflow Vulnerability in Tenda AC8 Router

CVE-2024-4065

Summary

A severe buffer overflow vulnerability exists in the Tenda AC8 router's remote management functionality. Specifically, the affected function, formSetRebootTimer, is located in the /goform/SetRebootTimer file. By manipulating the rebootTime parameter, attackers can trigger a stack-based buffer overflow remotely. Exploitation of this vulnerability could lead to unauthorized access and control over the device. Despite early disclosures to the vendor for remediation, there has been no response or mitigation from Tenda, increasing the risk for users. Hacked routers can lead to compromised networks, making timely updates and security assessments critical for device owners.

References