CVE-2024-10661

A vulnerability has been found in Tenda AC15 15.03.05.19 and classified as critical. This vulnerability affects the function SetDlnaCfg of the file /goform/SetDlnaCfg. The manipulation of the argument scanList leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
References
Link Resource
https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac15_stackflow_formDLNAserver/tenda_ac15_stackflow_formDLNAserver.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.282676 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.282676 Third Party Advisory VDB Entry
https://vuldb.com/?submit.434932 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:ac15_firmware:15.03.05.19:*:*:*:*:*:*:*
cpe:2.3:h:tenda:ac15:-:*:*:*:*:*:*:*

History

05 Nov 2024, 14:30

Type Values Removed Values Added
First Time Tenda ac15
Tenda ac15 Firmware
Tenda
Summary
  • (es) Se ha encontrado una vulnerabilidad en Tenda AC15 15.03.05.19 que se ha clasificado como crítica. Esta vulnerabilidad afecta a la función SetDlnaCfg del archivo /goform/SetDlnaCfg. La manipulación del argumento scanList provoca un desbordamiento de búfer en la región stack de la memoria. El ataque se puede iniciar de forma remota. El exploit se ha hecho público y puede utilizarse.
CWE CWE-787
CPE cpe:2.3:o:tenda:ac15_firmware:15.03.05.19:*:*:*:*:*:*:*
cpe:2.3:h:tenda:ac15:-:*:*:*:*:*:*:*
References () https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac15_stackflow_formDLNAserver/tenda_ac15_stackflow_formDLNAserver.md - () https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac15_stackflow_formDLNAserver/tenda_ac15_stackflow_formDLNAserver.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.282676 - () https://vuldb.com/?ctiid.282676 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.282676 - () https://vuldb.com/?id.282676 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.434932 - () https://vuldb.com/?submit.434932 - Third Party Advisory, VDB Entry
References () https://www.tenda.com.cn/ - () https://www.tenda.com.cn/ - Product

01 Nov 2024, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-11-01 16:15

Updated : 2024-11-05 14:30


NVD link : CVE-2024-10661

Mitre link : CVE-2024-10661

CVE.ORG link : CVE-2024-10661


JSON object : View

Products Affected

tenda

  • ac15
  • ac15_firmware
CWE
CWE-787

Out-of-bounds Write

CWE-121

Stack-based Buffer Overflow