Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info.
The vulnerability results from a stack buffer overflow in the get_parentControl_list_Info function. The 'urls' parameter passed to this function is not properly validated for length, allowing an attacker to submit an excessively long value. This results in overwriting stack memory areas, which can lead to hijacking control over program execution flow.
An unauthenticated remote attacker can achieve arbitrary code execution (RCE) on the device, gaining full control over the router, including its confidentiality, integrity, and availability.
Patches available from the manufacturer should be applied in accordance with the references. Until updates are released, it is recommended to restrict access to the device management interface exclusively to trusted local networks and disable remote management over the Internet.
Tenda AC8V4 with software version V16.03.34.06
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTenda Ac8
HWTendav4Tenda Ac8 Firmware
OSTenda16.03.34.06
Related vulnerabilities
Buffer Overflow w Tenda AC8 — funkcja fromSetRouteStatic
Tenda AC8V4 — stack overflow w parametrze shareSpeed (RCE)
Tenda AC8V4 — stack overflow przez parametr shareSpeed (RCE)
Tenda AC8V4 — stack-based buffer overflow w funkcji WifiExtraSet
Tenda AC8v4 — stack overflow w funkcji setSchedWifi (schedEndTime)