Vulnerabilities > CVE-2023-37717 - Out-of-bounds Write vulnerability in Tenda products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

tenda

CWE-787

critical

NVD

Published: 2023-07-14

Updated: 2023-07-21

Summary

Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN, AC10 V1.0, AC1206 V1.0, AC7 V1.0, AC5 V1.0, and AC9 V3.0 were discovered to contain a stack overflow in the page parameter in the function fromDhcpListClient.

Vulnerable Configurations

Part	Description	Count
OS	Tenda Tenda F1202 Firmware 1.2.0.20\(408\) Tenda F1202 Firmware 1.0Br Tenda Fh1202 Firmware 1.2.0.19_En Tenda Ac10 Firmware 1.0 Tenda Ac1206 Firmware 1.0 Tenda AC7 Firmware 1.0 Tenda AC5 Firmware 1.0 Tenda AC9 Firmware 3.0	8
Hardware	Tenda Tenda F1202 - Tenda Fh1202 - Tenda Ac10 - Tenda Ac1206 - Tenda AC7 - Tenda AC5 - Tenda AC9 -	7

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

References

https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/fromDhcpListClient/repot.md