ID
VAR-202401-0743
CVE
CVE-2024-0532
TITLE
Shenzhen Tenda Technology Co.,Ltd. of A15 Out-of-bounds write vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects the function set_repeat5 of the file /goform/WifiExtraSet of the component Web-based Management Interface. The manipulation of the argument wpapsk_crypto2_4g/wpapsk_crypto5g leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. of A15 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability is caused by the wpapsk_crypto2_4g parameter of the /goform/WifiExtraSet file failing to correctly verify the length of the input data. A remote attacker can use this vulnerability to execute arbitrary code on the system or cause a denial of Service attacks
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | a15 | scope: | eq | version: | 15.13.07.13 | Trust: 1.6 |
| vendor: | tenda | model: | a15 | scope: | eq | version: | a15 firmware 15.13.07.13 | Trust: 0.8 |
| vendor: | tenda | model: | a15 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | a15 | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-119 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
PATCH
| title: | Patch for Tenda A15 wpapsk_crypto2_4g parameter buffer overflow vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/521186 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-0532 | Trust: 3.2 |
| db: | VULDB | id: | 250702 | Trust: 1.6 |
| db: | JVNDB | id: | JVNDB-2024-001447 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2024-05736 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/yaoyue123/iot/blob/main/tenda/a15/wifextraset.md | Trust: 1.8 |
| url: | https://vuldb.com/?id.250702 | Trust: 1.6 |
| url: | https://vuldb.com/?submit.262690 | Trust: 1.0 |
| url: | https://www.tenda.com.cn/ | Trust: 1.0 |
| url: | https://vuldb.com/?ctiid.250702 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-0532 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2024-05736 |
| db: | JVNDB | id: | JVNDB-2024-001447 |
| db: | NVD | id: | CVE-2024-0532 |
LAST UPDATE DATE
2025-02-18T23:34:09.764000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-05736 | date: | 2024-01-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-001447 | date: | 2024-02-05T05:07:00 |
| db: | NVD | id: | CVE-2024-0532 | date: | 2025-02-16T09:15:07.263 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-05736 | date: | 2024-01-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-001447 | date: | 2024-02-05T00:00:00 |
| db: | NVD | id: | CVE-2024-0532 | date: | 2024-01-15T02:15:15.650 |