Stack-Based Buffer Overflow in Tenda O3 Products
CVE-2024-6965

8.8HIGH

Key Information:

Vendor: Tenda
Status: O3
Vendor: CVE Published:; 22 July 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A significant vulnerability has been identified in Tenda O3 version 1.0.0.10, resulting from improper handling of input parameters in the fromVirtualSet function. This flaw allows attackers to manipulate the arguments such as ip, localPort, publicPort, and app, leading to a stack-based buffer overflow. Because the vulnerability can be exploited remotely, it poses a severe risk to users, allowing unauthorized access and potential control over the affected device. Despite direct communication to the vendor about this issue, there has been no response, raising concerns about the timely mitigation of this threat. Organizations using Tenda O3 products should take proactive measures to secure their networks against this vulnerability.

Affected Version(s)

O3 1.0.0.10

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-6965 - Proof of Concept