CVEvulnerability

CVE-2024-10280

7.1 HIGH Published 2024-10-23 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-10-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:C
Weaknesses
CWE-476

Description

A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected configurations

• tenda ac15 firmware 15.03.05.18 • tenda ac15 firmware 15.03.05.19 • tenda ac7 firmware 15.03.06.44 • tenda ac10u firmware 15.03.06.48 • tenda ac10u firmware 15.03.06.49 • tenda ac500 firmware 1.0.0.14 • tenda ac500 firmware 1.0.0.16 • tenda ac500 firmware 2.0.1.9\(1307\) • tenda ac18 firmware 15.03.05.05 • tenda ac18 firmware 15.03.05.19\(6318\) • tenda ac9 firmware 15.03.2.13 • tenda ac9 firmware 15.03.05.14 • tenda ac9 firmware 15.03.05.19\(6318\) • tenda ac9 firmware 15.03.06.42 • tenda ac1206 firmware 15.03.06.23 • tenda ac6 firmware 15.03.06.23 • tenda ac10 firmware 16.03.10.13 • tenda ac10 firmware 16.03.10.20 • tenda ac10 firmware 16.03.48.19 • tenda ac10 firmware 16.03.48.23 • tenda ac8 firmware 16.03.34.06 • tenda ac8 firmware 16.03.34.09

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References