CVE-2024-10280: Tenda AC6/AC7/AC8/AC9/AC10/AC10U/AC15/AC18/AC500/AC1206 GetIPTV websReadEvent null pointer dereference
A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10280?
CVE-2024-10280 has been rated as a problematic vulnerability.
How do I fix CVE-2024-10280?
To fix CVE-2024-10280, update the affected Tenda firmware to the latest available version.
Which Tenda devices are impacted by CVE-2024-10280?
CVE-2024-10280 affects several Tenda devices including AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500, and AC1206 running specific firmware versions.
What is the nature of the vulnerability in CVE-2024-10280?
CVE-2024-10280 involves a manipulation of the Content-Length argument in the websReadEvent function related to the /goform/GetIPTV file.
When was CVE-2024-10280 discovered?
CVE-2024-10280 was disclosed affecting Tenda devices up to the date of October 22, 2024.