Stack-based Buffer Overflow Vulnerability in Tenda W9 WiFi Router

CVE-2024-4243

Summary

The Tenda W9 WiFi router version 1.0.0.7 contains a stack-based buffer overflow vulnerability in the formwrlSSIDset function, located in the /goform/wifiSSIDset file. By manipulating the ssidIndex argument, an attacker can exploit this vulnerability remotely, allowing unauthorized access to critical system resources. This vulnerability has been publicly disclosed, increasing the risk of potential exploitation. The vendor, Tenda, has been notified about this issue, but there has been no response or acknowledgment. Users are strongly advised to take immediate action to safeguard their systems until a patch can be provided.

References