Stack-Based Buffer Overflow in Tenda O3 Products

CVE-2024-6965

What is CVE-2024-6965?

A significant vulnerability has been identified in Tenda O3 version 1.0.0.10, resulting from improper handling of input parameters in the fromVirtualSet function. This flaw allows attackers to manipulate the arguments such as ip, localPort, publicPort, and app, leading to a stack-based buffer overflow. Because the vulnerability can be exploited remotely, it poses a severe risk to users, allowing unauthorized access and potential control over the affected device. Despite direct communication to the vendor about this issue, there has been no response, raising concerns about the timely mitigation of this threat. Organizations using Tenda O3 products should take proactive measures to secure their networks against this vulnerability.

References