Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Tenda AC18 Router: Stack Overflow via Form Parameter

CVE-2024-57582 · published 1 year ago
Summary

A vulnerability in the Tenda AC18 router's web interface allows attackers to cause a crash by sending a specially crafted request with a long value for the startIP parameter. This could potentially allow an attacker to disrupt the router's functionality. Router administrators should update the firmware to the latest version to prevent this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tenda ac18_firmware 15.03.05.19
cpe:2.3:o:tenda:ac18_firmware:15.03.05.19:*:*:*:*:*:*:*
Original advisory text
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function.
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published16 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-57582 · NVD
Track software like this
Free during beta