Stack-Based Buffer Overflow in Tenda W15E Router

CVE-2024-4122

Summary

A critical stack-based buffer overflow vulnerability exists in the Tenda W15E router, specifically within the formSetDebugCfg function located in the /goform/setDebugCfg file. This vulnerability arises from improper handling of the 'enable', 'level', and 'module' arguments, allowing an attacker to manipulate these inputs and potentially execute arbitrary code. The vulnerability can be exploited remotely, posing a significant risk to users as the exploit has already been publicly disclosed. Despite early notifications to the vendor regarding this issue, there has been no response, increasing the urgency for users to secure their devices.

References