ID
VAR-202404-0370
CVE
CVE-2024-4064
TITLE
Shenzhen Tenda Technology Co.,Ltd. of AC8 Out-of-bounds write vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. This vulnerability affects the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-261790 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. of AC8 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. AC8 is a wireless router device that provides network connection and wireless management functions. The vulnerability is caused by improper processing of password parameters. Attackers can exploit this vulnerability to remotely control the device
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | ac8 | scope: | eq | version: | 16.03.34.09 | Trust: 1.0 |
| vendor: | tenda | model: | ac8 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac8 | scope: | eq | version: | ac8 firmware 16.03.34.09 | Trust: 0.8 |
| vendor: | tenda | model: | ac8 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | jixiang tengda | model: | ac8 | scope: | eq | version: | 16.03.34.09 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Stack-based buffer overflow (CWE-121) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-4064 | Trust: 3.2 |
| db: | VULDB | id: | 261790 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2024-017197 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2024-20777 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/ac8/r7webssecurityhandler.md | Trust: 1.8 |
| url: | https://vuldb.com/?id.261790 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.316493 | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-4064 | Trust: 1.4 |
| url: | https://vuldb.com/?ctiid.261790 | Trust: 1.0 |
SOURCES
| db: | CNVD | id: | CNVD-2024-20777 |
| db: | JVNDB | id: | JVNDB-2024-017197 |
| db: | NVD | id: | CVE-2024-4064 |
LAST UPDATE DATE
2025-01-25T22:48:26.470000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-20777 | date: | 2024-04-28T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-017197 | date: | 2025-01-22T07:43:00 |
| db: | NVD | id: | CVE-2024-4064 | date: | 2025-01-21T19:12:43.877 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-20777 | date: | 2024-04-26T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-017197 | date: | 2025-01-22T00:00:00 |
| db: | NVD | id: | CVE-2024-4064 | date: | 2024-04-23T20:15:07.997 |