CVE-2024-2892

Summary

CVE-2024-2892 is a newly disclosed critical vulnerability affecting Tenda AC7 devices running version 15.03.06.44. The issue lies within the function formSetCfm in the file /goform/setcfm, which can be exploited through manipulation of the argument funcpara1, leading to a stack-based buffer overflow. The vulnerability is remotely exploitable, and the exploit code has been made public. No response has been received from the vendor regarding this disclosure, increasing the urgency for users to apply patches or workarounds to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.