CVE-2024-57579
Published: 16 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-57579 is a stack overflow vulnerability in the Tenda AC18 router, specifically version V15.03.05.19. The flaw occurs in the formSetClientState function when processing the limitSpeedUp parameter, classified under CWE-787 (Out-of-bounds Write). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
The vulnerability enables remote exploitation over the network by unauthenticated attackers with low complexity and no user interaction required. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data compromise, or denial of service on the affected device.
Mitigation details are available in the referenced GitHub repository at https://github.com/qijiale/Tenda/tree/main/6, published on 2025-01-16. No vendor patches or additional advisories are specified in the available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The stack overflow vulnerability in the formSetClientState function via the limitSpeedUp parameter in the Tenda AC18 router's web interface enables remote code execution on a public-facing application.