CVE-2024-57578
Published: 16 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-57578 is a stack overflow vulnerability in the Tenda AC18 router, specifically version V15.03.05.19. The flaw occurs in the formSetCfm function through the funcpara1 parameter, corresponding to CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by unauthenticated attackers on an adjacent network with low complexity and no user interaction required. Exploitation could grant high-impact control over confidentiality, integrity, and availability, likely enabling remote code execution or system compromise on the affected device.
Mitigation guidance is available in the referenced advisory at https://github.com/qijiale/Tenda/blob/main/5/Readme.md.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stack overflow in the Tenda AC18 router's web interface (formSetCfm function via funcpara1 parameter) enables remote code execution by exploiting a public-facing application.