Stack-Based Buffer Overflow in Tenda i21 Router Product
CVE-2024-4492

8.8HIGH

Key Information:

Vendor
Tenda
Status
I21
Vendor
CVE Published:
5 May 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A significant vulnerability exists in the Tenda i21 router, specifically within the 'formOfflineSet' function found in the '/goform/setStaOffline' file. An issue arises due to improper handling of the 'GO/ssidIndex' argument, leading to a stack-based buffer overflow. This flaw can be exploited remotely, allowing attackers to potentially execute arbitrary code or affect the device's operational integrity. This critical vulnerability was disclosed publicly, raising concerns about the security of affected products. Users of the Tenda i21 are urged to be aware of this security risk and to apply necessary mitigations.

Affected Version(s)

i21 1.0.0.14(4656)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-4492 - Proof of Concept

References

https://vuldb.com/?id.263081
vdb-entrytechnical-description
https://vuldb.com/?ctiid.263081
signaturepermissions-required
https://vuldb.com/?submit.323601
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

Credit

yhryhryhr_miemie (VulDB User)
.