CVE-2024-10280

A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
VulDBCNA
6.5 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
tendaac15_firmware
15.03.05.18
tendaac15_firmware
15.03.05.19
tendaac7_firmware
15.03.06.44
tendaac10u_firmware
15.03.06.48
tendaac10u_firmware
15.03.06.49
tendaac500_firmware
1.0.0.14
tendaac500_firmware
1.0.0.16
tendaac500_firmware
2.0.1.9\(1307\)
tendaac18_firmware
15.03.05.05
tendaac18_firmware
15.03.05.19\(6318\)
tendaac9_firmware
15.03.2.13
tendaac9_firmware
15.03.05.14
tendaac9_firmware
15.03.05.19\(6318\)
tendaac9_firmware
15.03.06.42
tendaac1206_firmware
15.03.06.23
tendaac6_firmware
15.03.06.23
tendaac10_firmware
16.03.10.13
tendaac10_firmware
16.03.10.20
tendaac10_firmware
16.03.48.19
tendaac10_firmware
16.03.48.23
tendaac8_firmware
16.03.34.06
tendaac8_firmware
16.03.34.09
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/JohenanLi/router_vuls/blob/main/websReadEvent/websReadEvent.md
https://vuldb.com/?ctiid.281555
https://vuldb.com/?id.281555
https://vuldb.com/?submit.426417
https://www.tenda.com.cn/