ID
VAR-202404-0164
CVE
CVE-2024-3874
TITLE
Shenzhen Tenda Technology Co.,Ltd. of W20E Stack-based buffer overflow vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in Tenda W20E 15.11.0.6. It has been declared as critical. This vulnerability affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260908. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. of W20E The firmware contains a stack-based buffer overflow vulnerability and an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda W20E is a wireless router developed by Tenda, mainly used to provide wireless network connection and management functions. Attackers can exploit this vulnerability to execute arbitrary code
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | w20e | scope: | eq | version: | 15.11.0.6 | Trust: 1.6 |
| vendor: | tenda | model: | w20e | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | w20e | scope: | - | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | w20e | scope: | eq | version: | w20e firmware 15.11.0.6 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | Stack-based buffer overflow (CWE-121) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-3874 | Trust: 3.2 |
| db: | VULDB | id: | 260908 | Trust: 1.6 |
| db: | JVNDB | id: | JVNDB-2024-019968 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2024-18609 | Trust: 0.6 |
REFERENCES
| url: | https://vuldb.com/?submit.312816 | Trust: 1.8 |
| url: | https://vuldb.com/?id.260908 | Trust: 1.6 |
| url: | https://vuldb.com/?ctiid.260908 | Trust: 1.0 |
| url: | https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/w20e/formsetremotewebmanage.md | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-3874 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2024-18609 |
| db: | JVNDB | id: | JVNDB-2024-019968 |
| db: | NVD | id: | CVE-2024-3874 |
LAST UPDATE DATE
2025-03-08T23:21:21.967000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-18609 | date: | 2024-04-19T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-019968 | date: | 2025-03-07T05:40:00 |
| db: | NVD | id: | CVE-2024-3874 | date: | 2025-03-06T15:00:11.560 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-18609 | date: | 2024-04-19T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-019968 | date: | 2025-03-07T00:00:00 |
| db: | NVD | id: | CVE-2024-3874 | date: | 2024-04-16T16:15:09.240 |