Sign-up

ID

VAR-202405-0051


CVE

CVE-2024-4491


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  i21  Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-017623

DESCRIPTION

A vulnerability classified as critical was found in Tenda i21 1.0.0.14(4656). This vulnerability affects the function formGetDiagnoseInfo. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263080. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Shenzhen Tenda Technology Co.,Ltd. of i21 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the parameter cmdinput of the function formGetDiagnoseInfo failing to correctly verify the length of the input data. Remote attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

Trust: 2.16

sources: NVD: CVE-2024-4491 // JVNDB: JVNDB-2024-017623 // CNVD: CNVD-2024-22404

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-22404

AFFECTED PRODUCTS

vendor:tendamodel:i21scope:eqversion:1.0.0.14\(4656\)

Trust: 1.0

vendor:tendamodel:i21scope: - version: -

Trust: 0.8

vendor:tendamodel:i21scope:eqversion:i21 firmware 1.0.0.14(4656)

Trust: 0.8

vendor:tendamodel:i21scope:eqversion: -

Trust: 0.8

vendor:tendamodel:i21scope:eqversion:1.0.0.14(4656)

Trust: 0.6

sources: CNVD: CNVD-2024-22404 // JVNDB: JVNDB-2024-017623 // NVD: CVE-2024-4491

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2024-4491
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2024-4491
value: HIGH

Trust: 1.0

OTHER: JVNDB-2024-017623
value: HIGH

Trust: 0.8

CNVD: CNVD-2024-22404
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2024-4491
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2024-017623
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2024-22404
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2024-4491
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: JVNDB-2024-017623
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-22404 // JVNDB: JVNDB-2024-017623 // NVD: CVE-2024-4491 // NVD: CVE-2024-4491

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:CWE-121

Trust: 1.0

problemtype:Stack-based buffer overflow (CWE-121) [ others ]

Trust: 0.8

problemtype: Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-017623 // NVD: CVE-2024-4491

EXTERNAL IDS

db:NVDid:CVE-2024-4491

Trust: 3.2

db:VULDBid:263080

Trust: 1.8

db:JVNDBid:JVNDB-2024-017623

Trust: 0.8

db:CNVDid:CNVD-2024-22404

Trust: 0.6

sources: CNVD: CNVD-2024-22404 // JVNDB: JVNDB-2024-017623 // NVD: CVE-2024-4491

REFERENCES

url:https://vuldb.com/?id.263080

Trust: 1.8

url:https://vuldb.com/?submit.323600

Trust: 1.8

url:https://vuldb.com/?ctiid.263080

Trust: 1.0

url:https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/i/i21/formgetdiagnoseinfo.md

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2024-4491

Trust: 0.8

url:https://www.cnnvd.org.cn/home/globalsearch?keyword=cve-2024-4491

Trust: 0.6

sources: CNVD: CNVD-2024-22404 // JVNDB: JVNDB-2024-017623 // NVD: CVE-2024-4491

SOURCES

db:CNVDid:CNVD-2024-22404
db:JVNDBid:JVNDB-2024-017623
db:NVDid:CVE-2024-4491

LAST UPDATE DATE

2025-01-30T23:00:40.338000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-22404date:2024-05-14T00:00:00
db:JVNDBid:JVNDB-2024-017623date:2025-01-28T08:01:00
db:NVDid:CVE-2024-4491date:2025-01-27T18:35:34.717

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-22404date:2024-05-11T00:00:00
db:JVNDBid:JVNDB-2024-017623date:2025-01-28T00:00:00
db:NVDid:CVE-2024-4491date:2024-05-05T00:15:07.373