CVE-2024-10280
A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.80% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-476
- Affected
- tenda/ac15 firmware · tenda/ac7 firmware · tenda/ac10u firmware · tenda/ac500 firmware · tenda/ac18 firmware · tenda/ac9 firmware · tenda/ac1206 firmware · tenda/ac6 firmware · tenda/ac10 firmware · tenda/ac8 firmware
- Source
- cna@vuldb.com
References
- https://github.com/JohenanLi/router_vuls/blob/main/websReadEvent/websReadEvent.mdThird Party Advisory
- https://vuldb.com/?ctiid.281555Permissions Required, VDB Entry
- https://vuldb.com/?id.281555Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.426417Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.