Details of VAR-202404-1583

ID

VAR-202404-1583

CVE

CVE-2024-32317

TITLE

Shenzhen Tenda Technology Co.,Ltd. of AC10 Stack-based buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-020537

DESCRIPTION

Tenda AC10 v4.0 V16.03.10.13 and V16.03.10.20 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function. Shenzhen Tenda Technology Co.,Ltd. of AC10 A stack-based buffer overflow vulnerability exists in the firmware.Information may be obtained and information may be tampered with. Tenda A18 is a dual-band Gigabit wireless router, mainly for 200M and above fiber users. Tenda AC10 has a buffer overflow vulnerability, which is caused by the adslPwd parameter of the formWanParameterSetting method failing to correctly verify the length of the input data. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2024-32317 // JVNDB: JVNDB-2024-020537 // CNVD: CNVD-2025-16320

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-16320

AFFECTED PRODUCTS

vendor:	tenda	model:	ac10	scope:	eq	version:	16.03.10.13	Trust: 1.6
vendor:	tenda	model:	ac10	scope:	eq	version:	16.03.10.20	Trust: 1.6
vendor:	tenda	model:	ac10	scope:	eq	version:	ac10 firmware 16.03.10.13	Trust: 0.8
vendor:	tenda	model:	ac10	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	ac10	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	ac10	scope:	eq	version:	ac10 firmware 16.03.10.20	Trust: 0.8
vendor:	tenda	model:	ac10	scope:	eq	version:	4.0	Trust: 0.6

sources: CNVD: CNVD-2025-16320 // JVNDB: JVNDB-2024-020537 // NVD: CVE-2024-32317

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-32317
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2024-020537
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2025-16320
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2025-16320
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:N/AC:H/AU:N/C:C/I:P/A:N
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	4.9
impactScore:	7.8
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-32317
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	4.7
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2024-020537
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-16320 // JVNDB: JVNDB-2024-020537 // NVD: CVE-2024-32317

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-020537 // NVD: CVE-2024-32317

PATCH

title:

Patch for Tenda AC10 Buffer Overflow Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/710301

Trust: 0.6

sources: CNVD: CNVD-2025-16320

EXTERNAL IDS

db:	NVD	id:	CVE-2024-32317	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-020537	Trust: 0.8
db:	CNVD	id:	CNVD-2025-16320	Trust: 0.6

sources: CNVD: CNVD-2025-16320 // JVNDB: JVNDB-2024-020537 // NVD: CVE-2024-32317

REFERENCES

url:	https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/ac10/v16.03.10.13/formwanparametersetting.md	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2024-32317	Trust: 0.8

sources: CNVD: CNVD-2025-16320 // JVNDB: JVNDB-2024-020537 // NVD: CVE-2024-32317

SOURCES

db:	CNVD	id:	CNVD-2025-16320
db:	JVNDB	id:	JVNDB-2024-020537
db:	NVD	id:	CVE-2024-32317

LAST UPDATE DATE

2025-07-20T23:20:50.708000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-16320	date:	2025-07-18T00:00:00
db:	JVNDB	id:	JVNDB-2024-020537	date:	2025-03-18T03:14:00
db:	NVD	id:	CVE-2024-32317	date:	2025-03-17T14:22:37.120

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-16320	date:	2025-07-18T00:00:00
db:	JVNDB	id:	JVNDB-2024-020537	date:	2025-03-18T00:00:00
db:	NVD	id:	CVE-2024-32317	date:	2024-04-17T16:15:09.073