Stack-based Buffer Overflow in Tenda W15E Router

CVE-2024-4125

Summary

A significant security flaw has been discovered in the Tenda W15E router, specifically within the formSetStaticRoute function located in the /goform/setStaticRoute file. This vulnerability is characterized by a stack-based buffer overflow triggered by improper handling of the 'staticRouteIndex' argument. Attackers can exploit this vulnerability remotely, potentially leading to unauthorized access and control over the affected device. Despite efforts to inform the vendor about the issue, there has been no response, raising concerns about the patching and mitigation of this critical security risk.

References