Stack-Based Buffer Overflow in Tenda i21 Router

CVE-2024-4248

What is CVE-2024-4248?

A significant security vulnerability has been identified in the Tenda i21 router, specifically affecting version 1.0.0.14(4656). This vulnerability lies within the function formQosManage_user, where improper handling of the ssidIndex argument can lead to a stack-based buffer overflow. This may allow an attacker to execute arbitrary code or crash the device, and the exploitation can be performed remotely, posing a severe risk to users' networks. Despite attempts to notify the vendor, Tenda has not responded regarding any mitigation steps. It is crucial for users to be aware of this issue and to apply necessary security measures to protect their devices.

References