Tenda A18 15.13.07.13: Remote Code Execution Possible

Summary

A security flaw in the Tenda A18 router's settings page allows an attacker to potentially take control of the device. This can happen if a hacker sends a specially crafted request to the router's settings page. To protect your device, update to the latest firmware as soon as possible.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	a18_firmware	15.13.07.13	–

Original title

A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-b...

Original description

A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/master-abc/cve/issues/38 Issue Tracking
https://vuldb.com/?ctiid.347114 Permissions Required VDB Entry
https://vuldb.com/?id.347114 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754675 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product