CVE-2018-14557: Buffer Overflow
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)CN(AC9), and AC10 devices with firmware through V15.03.06.23CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the page parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, a causing buffer overflow.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-14557.
What is the severity of CVE-2018-14557?
The severity of CVE-2018-14557 is high with a CVSS score of 7.5.
Which devices are affected by CVE-2018-14557?
Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10) are affected by CVE-2018-14557.
What is the vulnerability in Tenda devices?
The vulnerability in Tenda devices is a buffer overflow vulnerability in the router's web server (httpd).
Is there a fix available for CVE-2018-14557?
Yes, make sure to update the firmware on your Tenda device to a version higher than V15.03.06.44_CN(AC7) for AC7, V15.03.05.19(6318)_CN(AC9) for AC9, and V15.03.06.23_CN(AC10) for AC10.