CVE-2024-4492 HIGH

CVE-2024-4492: Tenda i21 setStaOffline formOfflineSet stack-based overflow

Vendor Tenda
Product i21
Weakness CWE-121
Published May 5, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). This issue affects the function formOfflineSet of the file /goform/setStaOffline. The manipulation of the argument GO/ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263081 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

May 5, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-1347 Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities CVE-2020-36967 Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH) CVE-2024-5507 Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-40892 PJSIP: Stack buffer overflow in pjsip_auth_create_digest2() CVE-2024-4251 Tenda i21 DhcpSetSe fromDhcpSetSer stack-based overflow