PoC Index

CVE-2024-0994

CRITICAL 9.8EPSS 1.7%

A vulnerability was found in Tenda W6 1.0.0.9(4122). It has been declared as critical. Affected by this vulnerability is the function formSetCfm of the file /goform/setcfm of the component httpd. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252259. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
8.3 HIGHAV:N/AC:L/Au:M/C:C/I:C/A:C
EPSS
1.66% chance of exploitation in the next 30 days, 75th percentile
Published
2024-01-29
Updated
2024-11-12

Proof-of-concept exploits (1)

References

Related