// For flags

CVE-2020-13392

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/setcfm funcpara1 parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.

Se detectó un problema en dispositivos Tenda AC6 versiones V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, y AC18 V15.03.05.19(6318 _)_CN. Se presenta una vulnerabilidad de desbordamiento de búfer en el servidor web del enrutador: httpd. Mientras procesa el parámetro funcpara1 de /goform/setcfm para una petición POST, un valor es usado directamente en un sprintf para una variable local colocada en la pila, que sobrescribe la dirección de retorno de una función. Un atacante puede construir una carga útil para llevar a cabo ataques de ejecución de código arbitrario.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-05-22 CVE Reserved
  • 2020-05-22 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2024-08-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Tendacn
Search vendor "Tendacn"
 Ac6 Firmware
Search vendor "Tendacn" for product "Ac6 Firmware"
 v15.03.05.19_multi_td01
Search vendor "Tendacn" for product "Ac6 Firmware" and version "v15.03.05.19_multi_td01"
-
Affected
in Tendacn
Search vendor "Tendacn"
 Ac6
Search vendor "Tendacn" for product "Ac6"
 1.0
Search vendor "Tendacn" for product "Ac6" and version "1.0"
-
Safe
Tendacn
Search vendor "Tendacn"
 Ac9 Firmware
Search vendor "Tendacn" for product "Ac9 Firmware"
 v15.03.05.19\(6318\)
Search vendor "Tendacn" for product "Ac9 Firmware" and version "v15.03.05.19\(6318\)"
-
Affected
in Tendacn
Search vendor "Tendacn"
 Ac9
Search vendor "Tendacn" for product "Ac9"
 1.0
Search vendor "Tendacn" for product "Ac9" and version "1.0"
-
Safe
Tendacn
Search vendor "Tendacn"
 Ac15 Firmware
Search vendor "Tendacn" for product "Ac15 Firmware"
 v15.03.05.19_multi_td01
Search vendor "Tendacn" for product "Ac15 Firmware" and version "v15.03.05.19_multi_td01"
-
Affected
in Tendacn
Search vendor "Tendacn"
 Ac15
Search vendor "Tendacn" for product "Ac15"
 1.0
Search vendor "Tendacn" for product "Ac15" and version "1.0"
-
Safe
Tendacn
Search vendor "Tendacn"
 Ac18 Firmware
Search vendor "Tendacn" for product "Ac18 Firmware"
 v15.03.05.19\(6318\)
Search vendor "Tendacn" for product "Ac18 Firmware" and version "v15.03.05.19\(6318\)"
-
Affected
in Tendacn
Search vendor "Tendacn"
 Ac18
Search vendor "Tendacn" for product "Ac18"
--
Safe
Tendacn
Search vendor "Tendacn"
 Ac9 Firmware
Search vendor "Tendacn" for product "Ac9 Firmware"
 v15.03.06.42_multi
Search vendor "Tendacn" for product "Ac9 Firmware" and version "v15.03.06.42_multi"
-
Affected
in Tendacn
Search vendor "Tendacn"
 Ac9
Search vendor "Tendacn" for product "Ac9"
 3.0
Search vendor "Tendacn" for product "Ac9" and version "3.0"
-
Safe