Vulnerability details

CVE-2024-11056

Tenda AC10Tenda ac10_firmware

Tenda AC10 WifiExtraSet FUN_0046AC38 stack-based overflow

CVSS 4.0

8.7High

Official description

A vulnerability, which was classified as critical, was found in Tenda AC10 16.03.10.13. Affected is the function FUN_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.8High	3.1	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
8.8High	3.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
9.0High	2.0	CVEProject cvelistV5 (CNA) (VulDB)	`AV:N/AC:L/Au:S/C:C/I:C/A:C`

Affected products

Vendor	Product	Versions	Source
Tenda	AC10	16.03.10.13	CVEProject cvelistV5 (CNA)
Tenda	ac10_firmware	16.03.10.13	CISA ADP / Vulnrichment

References and advisories

https://vuldb.com/?id.283800 vdb-entrytechnical-description
https://vuldb.com/?ctiid.283800 signaturepermissions-required
https://vuldb.com/?submit.439358 third-party-advisory
https://tasty-foxtrot-3a8.notion.site/Tenda-AC10v4-stack-overflow-1380448e619580409bb1e1ac85f45570 exploit
https://www.tenda.com.cn/ product

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2024-11-10
Last updated: 2024-11-12
State: Published
Assigner (CNA): VulDB

Exploit prediction (EPSS)

1.08%

Probability of exploitation in 30 days

65.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-121
Stack-based Buffer Overflow
CWE-119
Memory Corruption