Ax12 Firmware CVE-2024-40412

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2024-07-10 cve@mitre.org

Buffer Overflow Tenda Stack Overflow Ax12 Firmware

6.8

CVSS 3.1 · Vendor: mitre

Share

Severity by source

Vendor (mitre) PRIMARY

6.8 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

1

CVE Published

Jul 10, 2024 - 16:15 cve.org

MEDIUM 6.8

DescriptionCVE.org

Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function.

AnalysisAI

Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-121. Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function. Affected products include: Tenda Ax12 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Ax12 Firmware

View all

CVE-2024-28383 CRITICAL Act Now POC

Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 functio

CVE-2023-49437 CRITICAL Act Now POC

Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /gof

CVE-2023-49428 CRITICAL Act Now POC

Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /gofo

CVE-2023-49426 CRITICAL Act Now POC

Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.

CVE-2023-49425 CRITICAL Act Now POC

Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterC

CVE-2023-49424 CRITICAL Act Now POC

Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg

CVE-2022-28082 CRITICAL Act Now POC

Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlLis

CVE-2022-28561 CRITICAL Act Now POC

There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03

CVE-2022-45980 HIGH This Week POC

Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .

CVE-2022-45977 HIGH This Week POC

Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function. Rat

CVE-2022-45043 HIGH This Week POC

Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set. Rated high severity

CVE-2024-39963 HIGH This Week POC

AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01

Same weakness CWE-121 – Stack-based Buffer Overflow

View all

CVE-2025-0282 CRITICAL POC

CVE-2025-22457 CRITICAL POC

CVE-2012-10060 CRITICAL POC

CVE-2012-10053 CRITICAL POC

CVE-2013-10064 CRITICAL POC

CVE-2012-10023 MEDIUM POC

CVE-2012-10058 CRITICAL POC

CVE-2013-10068 CRITICAL POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2017-11882 HIGH POC

CVE-2010-3333 HIGH POC

Share

CVE-2024-40412 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy