CVE-2024-4493

Tenda i21 formSetAutoPing stack-based overflow

A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). Affected is the function formSetAutoPing. The manipulation of the argument ping1/ping2 leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263082 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Es wurde eine Schwachstelle in Tenda i21 1.0.0.14(4656) gefunden. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion formSetAutoPing. Mittels Manipulieren des Arguments ping1/ping2 mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.

Affected

Tenda · i21

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 VULDB

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

1.45% chance of exploitation in the next 30 days, 73rd percentile

Published

2024-05-05

Updated

2024-08-01

Proof-of-concept exploits (1)

• abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formSetAutoPing.md70★ · 2026-08-21

Security advisories

• https://vuldb.com/?ctiid.263082
• https://vuldb.com/?id.263082
• https://vuldb.com/?submit.323602

References

• CVE Record
• NVD entry