CVE-2024-33835

Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the remoteIp parameter from formSetSafeWanWebMan function

Critical · published May 1, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

🚨 A single rogue input is all it takes to trigger a stack overflow in Tenda AC18 routers! This vulnerability is like a restaurant chef who misjudges the portion of an ingredient, causing the whole dish to overflow and spill everywhere—disastrous for both the kitchen and diners! An attacker could exploit this stack overflow to crash the router or potentially execute arbitrary code, leaving your network completely vulnerable and in disarray. Imagine an intruder taking control of your internet connection, snooping on your data, or even launching attacks on other networks. Absolutely devastating! 🔥

Put simply

This vulnerability is like a restaurant chef who misjudges the portion of an ingredient, causing the whole dish to overflow and spill everywhere—disastrous for both the kitchen and diners! The stack overflow vulnerability resides in the remoteIp parameter of the formSetSafeWanWebMan function, allowing attackers to overflow the stack and manipulate memory execution.

What to do

An attacker could exploit this stack overflow to crash the router or potentially execute arbitrary code, leaving your network completely vulnerable and in disarray. Imagine an intruder taking control of your internet connection, snooping on your data, or even launching attacks on other networks. Absolutely devastating! 🔥 Update your Tenda AC18 firmware immediately to the latest version available. Additionally, review your network settings to minimize exposure and consider implementing firewalls to restrict access. Don't wait—this is critical! ⚡ You've got this! Act quickly, and you'll restore security to your network in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00817 · 56.7th percentile
Published
2024-05-01T00:00Z
EPSS history
Timeline
  • 01 MAY 00:00Z
    Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the remoteIp parameter from formSetSafeWanWebMan function
    cvelistv5