Remote Stack-Based Buffer Overflow in Tenda W9 Router

CVE-2024-4244

Summary

A critical vulnerability has been identified in the Tenda W9 router, specifically in the function fromDhcpSetSer within the /goform/DhcpSetSer file. This issue allows an attacker to exploit a stack-based buffer overflow by manipulating DHCP-related arguments, including dhcpStartIp, dhcpEndIp, dhcpGw, dhcpMask, dhcpLeaseTime, dhcpDns1, and dhcpDns2. The vulnerability can be exploited remotely, making it particularly dangerous. Publicly disclosed and unaddressed by the vendor, it raises serious security concerns for users of the affected version 1.0.0.7 (4456). Immediate action is recommended to mitigate potential risks.

References