CVE-2023-40891
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the firewallEn parameter at the /goform/SetFirewallCfg endpoint.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the organization's network security.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn
See all- CVE-2023-40900Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow via parameter list at the endpoint /goform/SetNetControlList.
- CVE-2023-40899Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability due to improper handling of the macFilterType and deviceList parameters at /goform/setMacFilterCfg.
- CVE-2023-40898Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the timeZone parameter at the /goform/SetSysTimeCfg endpoint.
- CVE-2023-40897Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the mac parameter at /goform/GetParentControlInfo.
- CVE-2023-40896Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability due to improper handling of parameter list and bindnum at the /goform/SetIpMacBind endpoint.
- CVE-2023-40895Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow via parameter list at the endpoint /goform/SetVirtualServerCfg.
- CVE-2023-40893Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the time parameter at /goform/PowerSaveSet.
- CVE-2023-40892Critical
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the parameters schedStartTime and schedEndTime at /goform/openSchedWifi.
Original NVD description (English source)
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter firewallEn at /goform/SetFirewallCfg.