Tenda Router Allows Remote Attack via Malicious Device Name

Summary

A vulnerability in the Tenda A21 router's MAC Filtering Configuration allows an attacker to potentially cause the router to crash or behave unexpectedly by sending a specially crafted device name. This could allow the attacker to access or disrupt the router's functionality. It's recommended that Tenda A21 users update to the latest firmware to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	a21_firmware	1.0.0.0	–

Original title

A security vulnerability has been detected in Tenda A21 1.0.0.0. This vulnerability affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering Configuratio...

Original description

A security vulnerability has been detected in Tenda A21 1.0.0.0. This vulnerability affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering Configuration Endpoint. Such manipulation of the argument devName/mac leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/QIU-DIE/cve-nneeww/issues/3 Exploit Issue Tracking Mitigation Third Party Advisory
https://vuldb.com/?ctiid.347109 Permissions Required VDB Entry
https://vuldb.com/?id.347109 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754634 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product