Tenda W9 1.0.0.7(4456) httpd formQosManage_user ssidIndex minneskorruption

En kritisksvag punkt hittades i Tenda W9 1.0.0.7(4456). Som påverkar funktionen formQosManage_user av komponenten httpd. Manipulering av argumenten ssidIndex en okänd ingång leder till en sårbarhet klass minneskorruption svag punkt. Den rådgivande finns tillgänglig för nedladdning på github.com. Denna svaga punkt är känd som CVE-2024-0539. Attacken på nätet kan. Det finns tekniska detaljer känd. Han deklarerade proof-of-concept. Den exploit kan laddas ner från github.com. En möjlig åtgärd har utfärdats före och inte efter offentliggörandet.

Fält14/01/2024 18:2703/02/2024 09:30
vendorTendaTenda
nameW9W9
version1.0.0.7(4456)1.0.0.7(4456)
componenthttpdhttpd
functionformQosManage_userformQosManage_user
argumentssidIndexssidIndex
cwe121 (minneskorruption)121 (minneskorruption)
risk22
cvss3_vuldb_avNN
cvss3_vuldb_acLL
cvss3_vuldb_uiNN
cvss3_vuldb_sUU
cvss3_vuldb_cHH
cvss3_vuldb_iHH
cvss3_vuldb_aHH
cvss3_vuldb_ePP
cvss3_vuldb_rcRR
urlhttps://github.com/jylsec/vuldb/blob/main/Tenda/W9/4/README.mdhttps://github.com/jylsec/vuldb/blob/main/Tenda/W9/4/README.md
availability11
publicity11
urlhttps://github.com/jylsec/vuldb/blob/main/Tenda/W9/4/README.mdhttps://github.com/jylsec/vuldb/blob/main/Tenda/W9/4/README.md
cveCVE-2024-0539CVE-2024-0539
responsibleVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
date1705186800 (14/01/2024)1705186800 (14/01/2024)
cvss2_vuldb_avNN
cvss2_vuldb_acLL
cvss2_vuldb_ciCC
cvss2_vuldb_iiCC
cvss2_vuldb_aiCC
cvss2_vuldb_ePOCPOC
cvss2_vuldb_rcURUR
cvss2_vuldb_auSS
cvss2_vuldb_rlNDND
cvss3_vuldb_prLL
cvss3_vuldb_rlXX
cvss2_vuldb_basescore9.09.0
cvss2_vuldb_tempscore7.77.7
cvss3_vuldb_basescore8.88.8
cvss3_vuldb_tempscore8.08.0
cvss3_meta_basescore8.89.1
cvss3_meta_tempscore8.08.9
price_0day$0-$5k$0-$5k
cve_assigned1705186800 (14/01/2024)
cve_nvd_summaryA vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical. This issue affects the function formQosManage_user of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auS
cvss2_nvd_ciC
cvss2_nvd_iiC
cvss2_nvd_aiC
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cH
cvss3_cna_iH
cvss3_cna_aH
cve_cnaVulDB
cvss2_nvd_basescore9.0
cvss3_nvd_basescore9.8
cvss3_cna_basescore8.8

◂ TidigareÖversiktNästa ▸

Interested in the pricing of exploits?

See the underground prices here!