Remote Buffer Overflow Vulnerability in Tenda AX1806

CVE-2024-4237

Summary

A serious vulnerability has been identified in the Tenda AX1806 router's firmware version 1.0.0.1. The vulnerability resides in the R7WebsSecurityHandler function within the '/goform/execCommand' file. An attacker can exploit this flaw by manipulating the 'password' argument, leading to a stack-based buffer overflow. This allows for remote execution of malicious code, putting users' data and network security at high risk. The vulnerability has been publicly disclosed, and despite an early warning to Tenda, the company has not provided any response. Users of the affected product should take immediate steps to secure their devices and monitor for suspicious activity.

References