A vulnerability was found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this issue is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac6_stackflow_formSetDeviceName/tenda_ac6_stackflow_formSetDeviceName.md | Exploit |
| https://vuldb.com/?ctiid.282866 | Permissions Required Third Party Advisory |
| https://vuldb.com/?id.282866 | Permissions Required Third Party Advisory |
| https://vuldb.com/?submit.434935 | Third Party Advisory |
| https://www.tenda.com.cn/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
04 Nov 2024, 14:20
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:tenda:ac6_firmware:15.03.05.19:*:*:*:*:*:*:* cpe:2.3:h:tenda:ac6:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 9.0
v3 : 9.8 |
| CWE | CWE-787 | |
| First Time |
Tenda ac6 Firmware
Tenda ac6 Tenda |
|
| References | () https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac6_stackflow_formSetDeviceName/tenda_ac6_stackflow_formSetDeviceName.md - Exploit | |
| References | () https://vuldb.com/?ctiid.282866 - Permissions Required, Third Party Advisory | |
| References | () https://vuldb.com/?id.282866 - Permissions Required, Third Party Advisory | |
| References | () https://vuldb.com/?submit.434935 - Third Party Advisory | |
| References | () https://www.tenda.com.cn/ - Product |
02 Nov 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-02 14:15
Updated : 2024-11-04 14:20
NVD link : CVE-2024-10698
Mitre link : CVE-2024-10698
CVE.ORG link : CVE-2024-10698
JSON object : View
Products Affected
tenda
- ac6
- ac6_firmware