Vulnerability · Published Oct 24, 2024 · Assigned by VulDB

CVE-2024-10351Tenda RX9 Pro POST Request setMacFilterCfg sub_424CE0 stack-based overflow

High 8.8

In plain English

A high-severity stack buffer overflow in RX9 Pro from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 41.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Tenda RX9 Pro 22.03.02.20. It has been rated as critical. This issue affects the function sub_424CE0 of the file /goform/setMacFilterCfg of the component POST Request Handler. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
Tenda	RX9 Pro	22.03.02.20

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

VDB-281699 | Tenda RX9 Pro POST Request setMacFilterCfg sub_424CE0 stack-based overflow vdb-entry, technical-description
VDB-281699 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #427706 | Tenda Rx9 Router RX9 Pro Firmware V22.03.02.20 Stack-based Buffer Overflow third-party-advisory
https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/RX9/20/setMacFilterCfg.md exploit
https://www.tenda.com.cn/ product