ID
VAR-202401-1132
CVE
CVE-2024-0924
TITLE
Shenzhen Tenda Technology Co.,Ltd. of ac10u Stack-based buffer overflow vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49_multi_TDE01. This affects the function formSetPPTPServer. The manipulation of the argument startIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Shenzhen Tenda Technology Co.,Ltd. of ac10u A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the startIp parameter of the formSetPPTPServer function failing to correctly verify the length of the input data. An attacker can use this vulnerability to execute arbitrary code on the system or cause a denial of service attack
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | ac10u | scope: | eq | version: | 15.03.06.49_multi_tde01 | Trust: 1.0 |
| vendor: | tenda | model: | ac10u | scope: | eq | version: | ac10u firmware 15.03.06.49 multi tde01 | Trust: 0.8 |
| vendor: | tenda | model: | ac10u | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac10u | scope: | - | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac10u 15.03.06.49 multi tde01 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | Stack-based buffer overflow (CWE-121) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-0924 | Trust: 3.2 |
| db: | VULDB | id: | 252129 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2024-002002 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2024-13798 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/yaoyue123/iot/blob/main/tenda/ac10u/formsetpptpserver.md | Trust: 1.8 |
| url: | https://vuldb.com/?id.252129 | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-0924 | Trust: 1.4 |
| url: | https://vuldb.com/?ctiid.252129 | Trust: 1.0 |
SOURCES
| db: | CNVD | id: | CNVD-2024-13798 |
| db: | JVNDB | id: | JVNDB-2024-002002 |
| db: | NVD | id: | CVE-2024-0924 |
LAST UPDATE DATE
2024-08-14T15:20:41.090000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-13798 | date: | 2024-03-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-002002 | date: | 2024-02-07T04:38:00 |
| db: | NVD | id: | CVE-2024-0924 | date: | 2024-05-17T02:35:03.573 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-13798 | date: | 2024-03-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-002002 | date: | 2024-02-07T00:00:00 |
| db: | NVD | id: | CVE-2024-0924 | date: | 2024-01-26T15:15:08.537 |