Cyber Posture

CVE-2024-57579

Critical

Published: 16 January 2025

Published
16 January 2025
Modified
19 March 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0045 63.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2024-57579 is a stack overflow vulnerability in the Tenda AC18 router, specifically version V15.03.05.19. The flaw occurs in the formSetClientState function when processing the limitSpeedUp parameter, classified under CWE-787 (Out-of-bounds Write). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

The vulnerability enables remote exploitation over the network by unauthenticated attackers with low complexity and no user interaction required. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data compromise, or denial of service on the affected device.

Mitigation details are available in the referenced GitHub repository at https://github.com/qijiale/Tenda/tree/main/6, published on 2025-01-16. No vendor patches or additional advisories are specified in the available information.

Details

CWE(s)
CWE-787

Affected Products

tenda
ac18 firmware
15.03.05.19

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The stack overflow vulnerability in the formSetClientState function via the limitSpeedUp parameter in the Tenda AC18 router's web interface enables remote code execution on a public-facing application.

References