CVE-2024-2815: falha de alta gravidade em Tenda AC15
Tenda AC15 Cookie execCommand R7WebsSecurityHandler stack-based overflow
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 1.3%
A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand of the component Cookie Handler. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Tenda · AC15CVEs relacionadas — Tenda AC15
No mesmo produto, das mais perigosas para as menos.
CVE-2025-10442MEDIUMTenda AC9/AC15 exeCommand formexeCommand os command injectionEPSS 9.2%CVE-2025-0566HIGHTenda AC15 SetDevNetName formSetDevNetName stack-based overflowEPSS 9.1%CVE-2025-5850HIGHTenda AC15 HTTP POST Request SetLEDCf formsetschedled buffer overflowEPSS 6.9%CVE-2025-10443HIGHTenda AC9/AC15 exeCommand formexeCommand buffer overflowEPSS 4.6%CVE-2024-2812MEDIUMTenda AC15 WriteFacMac formWriteFacMac os command injectionEPSS 4.0%CVE-2024-2851MEDIUMTenda AC15 setsambacfg formSetSambaConf os command injectionEPSS 4.0%