CVE-2021-31627
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'index' parameter to execute arbitrary code.
Risk Assessment
The risk for the organization is the potential for remote code execution on the router, which could lead to network compromise, traffic interception, or further attacks on internal infrastructure.
Recommendation
Immediately update the Tenda AC9 router firmware to the latest available version that fixes this vulnerability. If no update is available, restrict access to the management interface.
Other vulnerabilities in Tenda AC9
See all- CVE-2022-36233Medium
A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.
- CVE-2021-31624High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'urls' parameter to execute arbitrary code on the device.
Original NVD description (English source)
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the index parameter.