Tenda HG9 Device Can Be Crashed by Malicious Network Traffic

Summary

A bug in the Tenda HG9 device's network settings can be exploited by an attacker to cause the device to crash, potentially disrupting internet access. This vulnerability can be triggered from anywhere on the network, and it's already been used by hackers. To protect your network, update your Tenda HG9 device with the latest security patch as soon as possible.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	hg9_firmware	300001138	–

Original title

A flaw has been found in Tenda HG9 300001138. This vulnerability affects unknown code of the file /boaform/formPing6. Executing a manipulation of the argument pingAddr can lead to stack-based buffe...

Original description

A flaw has been found in Tenda HG9 300001138. This vulnerability affects unknown code of the file /boaform/formPing6. Executing a manipulation of the argument pingAddr can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/QIU-DIE/cve-nneeww/issues/12 Exploit Issue Tracking Mitigation Third Party Advisory
https://vuldb.com/?ctiid.347219 Permissions Required VDB Entry
https://vuldb.com/?id.347219 Third Party Advisory VDB Entry
https://vuldb.com/?submit.755212 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product