PT-2021-17608
CVE-2021-27705
·
تاريخ النشر
2021-04-14
·
تاريخ التحديث
2021-04-20
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
Tenda G1 and G3 routers version v15.11.0.17(9502) CN
Description:
A buffer overflow issue allows remote attackers to execute arbitrary code via a crafted action/"qosIndex " request. This occurs because the
formQOSRuleDel function directly passes the parameter qosIndex to strcpy without limit.Recommendations:
For Tenda G1 and G3 routers version v15.11.0.17(9502) CN, as a temporary workaround, consider disabling the
formQOSRuleDel function until a patch is available. Restrict access to the API endpoint that handles the "qosIndex" request to minimize the risk of exploitation. Avoid using the parameter qosIndex in the affected API endpoint until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾