CVE-2024-0532: Tenda A15 Web-based Management Interface WifiExtraSet set_repeat5 stack-based overflow
Description
A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects the function set_repeat5 of the file /goform/WifiExtraSet of the component Web-based Management Interface. The manipulation of the argument wpapsk_crypto2_4g/wpapsk_crypto5g leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. In Tenda A15 15.13.07.13 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Betroffen ist die Funktion set_repeat5 der Datei /goform/WifiExtraSet der Komponente Web-based Management Interface. Dank Manipulation des Arguments wpapsk_crypto2_4g/wpapsk_crypto5g mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
Classification
CVE ID: CVE-2024-0532
CVSS Base Severity: HIGH
CVSS Base Score: 8.6
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
Vendor: Tenda
Product: A15
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.78% (probability of being exploited)
EPSS Percentile: 81.62% (scored less or equal to compared to others)
EPSS Date: 2025-03-17 (when was this score calculated)
References
https://vuldb.com/?id.250702https://vuldb.com/?ctiid.250702
https://vuldb.com/?submit.262690
https://github.com/yaoyue123/iot/blob/main/Tenda/A15/WifExtraSet.md
https://www.tenda.com.cn/