Tenda O1 Vulnerability: Stack-Based Buffer Overflow Threat Remotely Exploitable

CVE-2024-8227

Summary

A stack-based buffer overflow has been identified in Tenda O1 version 1.0.0.7(10648). The vulnerability arises in the function fromDhcpSetSer located in the /goform/DhcpSetSer file. Attackers can exploit this flaw by manipulating the arguments associated with DHCP configuration, including dhcpStartIp, dhcpEndIp, dhcpGw, dhcpMask, dhcpLeaseTime, dhcpDns1, and dhcpDns2. The exploit is remotely accessible, allowing potential attackers to initiate an attack from a distance. Despite early disclosure to the vendor, there has been no response regarding mitigation or patching efforts, increasing the urgency for users to secure their systems against potential exploits.

References