CVE-2024-28535

Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the mitInterface parameter of fromAddressNat function

High · published March 12, 2024

CVSS v3.1
8.0
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

⚡ A sneaky stack overflow lurking in Tenda AC18 could let an attacker take control! Just one manipulation of the mitInterface parameter could spell disaster. 🔥 Think of it like a crowded elevator — if too many people (data) push their way in, the doors can't handle the pressure and could break open, allowing anyone to step in uninvited. If exploited, this vulnerability could allow an attacker to execute arbitrary code on the device, potentially taking full control of your network. Imagine a stranger walking into your home and hijacking your Wi-Fi — that’s how vulnerable your setup could be!

Put simply

Think of it like a crowded elevator — if too many people (data) push their way in, the doors can't handle the pressure and could break open, allowing anyone to step in uninvited. This stack overflow vulnerability exists in the fromAddressNat function when handling the mitInterface parameter, allowing crafted input to overflow the stack and execute malicious code.

What to do

If exploited, this vulnerability could allow an attacker to execute arbitrary code on the device, potentially taking full control of your network. Imagine a stranger walking into your home and hijacking your Wi-Fi — that’s how vulnerable your setup could be! Patch your Tenda AC18 router to version V15.03.05.06 immediately to mitigate this risk. It's also a good idea to review your network logs for any suspicious activity and ensure strong passwords are in place. You've got this! With a quick update, your network will be much more secure! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00754 · 54.6th percentile
Published
2024-03-12T00:00Z
EPSS history
Timeline
  • 12 MAR 00:00Z
    Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the mitInterface parameter of fromAddressNat function
    cvelistv5