CVE-2024-2893 HIGH

CVE-2024-2893: Tenda AC7 SetOnlineDevName formSetDeviceName stack-based overflow

Vendor Tenda

Product AC7

Weakness CWE-121

Published March 26, 2024

Last update August 12, 2024

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. Affected by this issue is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257936. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

March 26, 2024 CVE published

August 12, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-2893 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2025-3710 ATEN LCD KVM over IP Switch CL5708IM - Stack-based Buffer Overflow CVE-2025-6486 TOTOLINK A3002R formWlanMultipleAP stack-based overflow CVE-2021-31383 Junos OS and Junos OS Evolved: In Point to MultiPoint (P2MP) scenarios receipt of various crafted packets causes RPD to core. CVE-2021-1185 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities CVE-2026-5349 Trendnet TEW-657BRM setup.cgi add_apcdb stack-based overflow