Buffer Overflow Vulnerability in Tenda i22 Router

CVE-2024-7582

Summary

A critical buffer overflow vulnerability has been identified in the Tenda i22 router, specifically in the form processing function 'formApPortalAccessCodeAuth'. This vulnerability arises due to improper handling of the 'accessCode' parameter, allowing remote attackers to exploit the overflow condition by sending crafted requests. The affected version is Tenda i22 1.0.0.3(4687). Successful exploitation could lead to unauthorized access and potential complete control over the device. The vendor has been informed about the issue but has not responded or issued a patch, raising concerns for IoT security users.

References