CVE-2023-38936

Summary

CVE-2023-38936 is a newly discovered vulnerability affecting multiple Tenda router models, including AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6, AC9 V3.0 V15.03.06.42_multi, and FH1205 V2.0.0.7(775). The vulnerability stems from a stack overflow issue in the formSetSpeedWan function, which can be triggered through a maliciously crafted speed_dir parameter. Successful exploitation of this vulnerability could lead to denial-of-service conditions or potentially more severe consequences, such as remote code execution. Users of the affected Tenda router models are advised to update their firmware to the latest version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.