CVE-2024-4237 HIGH

CVE-2024-4237: Tenda AX1806 execCommand R7WebsSecurityHandler stack-based overflow

Vendor Tenda
Product AX1806
Weakness CWE-121
Published April 26, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

April 26, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-16209 Fieldcomm Group HART-IP and hipserver - Stack-based Buffer Overflow CVE-2024-11795 Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2024-28934 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-2981 Tenda FH1202 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow CVE-2026-3137 CodeAstro Food Ordering System food_ordering.exe stack-based overflow