Stack-Based Buffer Overflow in Tenda 4G300 Device

CVE-2024-4167

Summary

A critical vulnerability has been identified in the Tenda 4G300 router, specifically affecting version 1.01.42. The issue arises due to improper handling of date and time input parameters within the function sub_422AA4, leading to a stack-based buffer overflow. This flaw can be exploited remotely, allowing attackers to manipulate input arguments for year, month, day, hour, minute, and second to gain unauthorized access or disrupt system operations. Despite early contact attempts, Tenda has not responded to notifications regarding this vulnerability, raising concerns about timely remediation and user safety.

References