Sign-up

ID

VAR-202501-2776


CVE

CVE-2024-57578


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  AC18  Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-002533

DESCRIPTION

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function. Shenzhen Tenda Technology Co.,Ltd. of AC18 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. There is a buffer overflow vulnerability in the Tenda AC18 15.03.05.19 version. The vulnerability is caused by the fact that the funcpara1 parameter of the formSetCfm function fails to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2024-57578 // JVNDB: JVNDB-2025-002533 // CNVD: CNVD-2025-05371

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-05371

AFFECTED PRODUCTS

vendor:tendamodel:ac18scope:eqversion:15.03.05.19

Trust: 1.6

vendor:tendamodel:ac18scope:eqversion:ac18 firmware 15.03.05.19

Trust: 0.8

vendor:tendamodel:ac18scope: - version: -

Trust: 0.8

vendor:tendamodel:ac18scope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2025-05371 // JVNDB: JVNDB-2025-002533 // NVD: CVE-2024-57578

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-57578
value: HIGH

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2024-57578
value: MEDIUM

Trust: 1.0

NVD: CVE-2024-57578
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-05371
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2025-05371
severity: MEDIUM
baseScore: 5.5
vectorString: AV:A/AC:L/AU:S/C:N/I:N/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-57578
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2024-57578
baseSeverity: MEDIUM
baseScore: 5.7
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2024-57578
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-05371 // JVNDB: JVNDB-2025-002533 // NVD: CVE-2024-57578 // NVD: CVE-2024-57578

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

problemtype: Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-002533 // NVD: CVE-2024-57578

EXTERNAL IDS

db:NVDid:CVE-2024-57578

Trust: 3.2

db:JVNDBid:JVNDB-2025-002533

Trust: 0.8

db:CNVDid:CNVD-2025-05371

Trust: 0.6

sources: CNVD: CNVD-2025-05371 // JVNDB: JVNDB-2025-002533 // NVD: CVE-2024-57578

REFERENCES

url:https://github.com/qijiale/tenda/blob/main/5/readme.md

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-57578

Trust: 1.4

sources: CNVD: CNVD-2025-05371 // JVNDB: JVNDB-2025-002533 // NVD: CVE-2024-57578

SOURCES

db:CNVDid:CNVD-2025-05371
db:JVNDBid:JVNDB-2025-002533
db:NVDid:CVE-2024-57578

LAST UPDATE DATE

2025-03-28T02:52:25.284000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-05371date:2025-03-19T00:00:00
db:JVNDBid:JVNDB-2025-002533date:2025-03-24T09:38:00
db:NVDid:CVE-2024-57578date:2025-03-17T14:53:41.467

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-05371date:2025-03-19T00:00:00
db:JVNDBid:JVNDB-2025-002533date:2025-03-24T00:00:00
db:NVDid:CVE-2024-57578date:2025-01-16T21:15:16.893