Tenda Router Diagnostic Ping Endpoint Allows Remote Code Execution

Summary

A flaw in the Tenda HG9 300001138 router's diagnostic tool allows an attacker to potentially execute malicious code remotely. This could allow a hacker to take control of the router and access your network. Update the router's software to the latest version to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	hg9_firmware	300001138	–

Original title

A vulnerability was detected in Tenda HG9 300001138. This affects an unknown part of the file /boaform/formPing of the component Diagnostic Ping Endpoint. Performing a manipulation of the argument ...

Original description

A vulnerability was detected in Tenda HG9 300001138. This affects an unknown part of the file /boaform/formPing of the component Diagnostic Ping Endpoint. Performing a manipulation of the argument pingAddr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/QIU-DIE/cve-nneeww/issues/11 Exploit Issue Tracking Mitigation Third Party Advisory
https://vuldb.com/?ctiid.347218 Permissions Required VDB Entry
https://vuldb.com/?id.347218 Third Party Advisory VDB Entry
https://vuldb.com/?submit.755211 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product