CVE-2024-30612

Name of the Vulnerable Software and Affected Versions Tenda AC10U version 15.03.06.48

Description The issue is related to a stack overflow vulnerability in the formSetClientState function, specifically affecting the deviceId, limitSpeed, and limitSpeedUp parameters. This vulnerability can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerable function is associated with the /goform/SetClientState API endpoint.

Recommendations For Tenda AC10U version 15.03.06.48, consider disabling the formSetClientState function until a patch is available. Restrict access to the /goform/SetClientState API endpoint to minimize the risk of exploitation. Avoid using the deviceId, limitSpeed, and limitSpeedUp parameters in the affected API endpoint until the issue is resolved.