Details of VAR-202401-0266

ID

VAR-202401-0266

CVE

CVE-2023-51970

TITLE

Tenda AX1803 buffer overflow vulnerability (CNVD-2024-02216)

Trust: 0.6

sources: CNVD: CNVD-2024-02216

DESCRIPTION

Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv. Tenda AX1803 is a dual-band Gigabit WIFI6 router from China's Tenda Company. This vulnerability is caused by the iptv.stb.mode parameter of the formSetIptv method failing to correctly verify the length of the input data. An attacker can use this vulnerability to execute arbitrary code on the system or Lead to denial of service attacks

Trust: 1.44

sources: NVD: CVE-2023-51970 // CNVD: CNVD-2024-02216

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-02216

AFFECTED PRODUCTS

vendor:	tenda	model:	ax1803	scope:	eq	version:	1.0.0.1	Trust: 1.0
vendor:	tenda	model:	ax1803	scope:	eq	version:	v1.0.0.1	Trust: 0.6

sources: CNVD: CNVD-2024-02216 // NVD: CVE-2023-51970

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-51970
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2024-02216
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-02216
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2023-51970
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2024-02216 // NVD: CVE-2023-51970

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.0

sources: NVD: CVE-2023-51970

PATCH

title:

Patch for Tenda AX1803 buffer overflow vulnerability (CNVD-2024-02216)

url:

https://www.cnvd.org.cn/patchInfo/show/516406

Trust: 0.6

sources: CNVD: CNVD-2024-02216

EXTERNAL IDS

db:	NVD	id:	CVE-2023-51970	Trust: 1.6
db:	CNVD	id:	CNVD-2024-02216	Trust: 0.6

sources: CNVD: CNVD-2024-02216 // NVD: CVE-2023-51970

REFERENCES

url:

https://grove-laser-8ad.notion.site/tenda-ax1803-buffer-overflow-in-getiptvinfo-f5918cc2828c49e78554f456bf7d4b36

Trust: 1.6

sources: CNVD: CNVD-2024-02216 // NVD: CVE-2023-51970

SOURCES

db:	CNVD	id:	CNVD-2024-02216
db:	NVD	id:	CVE-2023-51970

LAST UPDATE DATE

2024-08-14T15:15:36.325000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-02216	date:	2024-01-15T00:00:00
db:	NVD	id:	CVE-2023-51970	date:	2024-01-13T01:36:40.447

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-02216	date:	2024-01-15T00:00:00
db:	NVD	id:	CVE-2023-51970	date:	2024-01-10T16:15:49.977