CVE-2024-46049

Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function

Medium · published September 13, 2024

CVSS v3.1
5.7
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

⚠️ A stack overflow vulnerability lurks in the Tenda O6 firmware, hiding like a sneaky gremlin in a tech closet! Think of it as a crowded elevator that suddenly overloads; too many people pushing too hard can cause it to malfunction and stop working completely. In this case, the overloaded function can make the router go haywire! An attacker could exploit this stack overflow to crash the device, disrupting your network and leaving you in the digital dark. While it may not lead to a total takeover, it could still leave your router vulnerable while it’s down, affecting all devices connected to it.

Put simply

Think of it as a crowded elevator that suddenly overloads; too many people pushing too hard can cause it to malfunction and stop working completely. In this case, the overloaded function can make the router go haywire! The vulnerability arises in the formexeCommand function, where insufficient input validation allows for a stack overflow, potentially leading to denial of service or arbitrary code execution.

What to do

An attacker could exploit this stack overflow to crash the device, disrupting your network and leaving you in the digital dark. While it may not lead to a total takeover, it could still leave your router vulnerable while it’s down, affecting all devices connected to it. To safeguard your network, update the Tenda O6 firmware to the latest version available. Monitor for updates from Tenda and implement input validation on custom commands to prevent similar issues. You've got this! With a quick firmware update, your router will be back to superhero status in no time! 🛡️

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00617 · 48.9th percentile
Published
2024-09-13T00:00Z
EPSS history
Timeline
  • 13 SEP 00:00Z
    Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function
    cvelistv5