CVE-2024-2900

Tenda AC7 saveParentControlInfo stack-based overflow

CVSS 8.8 HIGHEPSS 1.7%CWE-121

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 1.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 Mar 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of the file /goform/saveParentControlInfo. The manipulation of the argument deviceId/time/urls leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257943. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Tenda · AC7

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/saveParentControlInfo_deviceId.md https://vuldb.com/?ctiid.257943 https://vuldb.com/?id.257943 https://vuldb.com/?submit.300364