Stack-Based Buffer Overflow in Tenda W15E Router

CVE-2024-4123

Summary

A critical security flaw has been identified in the Tenda W15E router, specifically within the function formSetPortMapping located in /goform/SetPortMapping. This vulnerability arises from improper handling of the portMappingServer, portMappingProtocol, portMappingWan, portMappingInternal, and portMappingExternal parameters, which can lead to a stack-based buffer overflow. Such an exploit allows an attacker to remotely execute code by carefully crafting input to the vulnerable parameters. As the exploit has been publicly disclosed, immediate action is advised to mitigate the risk. Users and administrators of the Tenda W15E should review their firmware versions and apply security updates as soon as they become available to protect against potential attacks.

References