CVE-2021-31624
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'urls' parameter to execute arbitrary code on the device.
Risk Assessment
The risk involves potential remote code execution by an unauthenticated attacker, which could lead to full device compromise, network traffic interception, or further attacks on local network devices.
Recommendation
Immediately update the Tenda AC9 router firmware to the latest available version that fixes this vulnerability. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda AC9
See all- CVE-2022-36233Medium
A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.
- CVE-2021-31627High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'index' parameter to execute arbitrary code.
Original NVD description (English source)
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the urls parameter.