Tenda i3 Router: Unauthenticated Remote Code Execution Possible

Summary

A security flaw in the Tenda i3 router's formSetCfm function can be exploited remotely, allowing an attacker to potentially take control of the device. This affects version 1.0.0.6(2204) and poses a risk to users who have not updated their firmware. We recommend that users update their router software to the latest version to prevent potential exploitation.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	i3_firmware	1.0.0.6\(2204\)	–

Original title

A flaw has been found in Tenda i3 1.0.0.6(2204). This impacts the function formSetCfm of the file /goform/setcfm. This manipulation of the argument funcpara1 causes stack-based buffer overflow. Rem...

Original description

A flaw has been found in Tenda i3 1.0.0.6(2204). This impacts the function formSetCfm of the file /goform/setcfm. This manipulation of the argument funcpara1 causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow