2024-10-23 16:03:56 +00:00
{
"id" : "CVE-2024-10280" ,
"sourceIdentifier" : "cna@vuldb.com" ,
"published" : "2024-10-23T14:15:04.500" ,
2024-11-01 15:03:21 +00:00
"lastModified" : "2024-11-01T14:03:20.267" ,
"vulnStatus" : "Analyzed" ,
2024-10-23 16:03:56 +00:00
"cveTags" : [ ] ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."
2024-11-01 15:03:21 +00:00
} ,
{
"lang" : "es" ,
"value" : "Se ha detectado una vulnerabilidad en Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 y AC1206 hasta 20241022. Se ha calificado como problem\u00e1tica. Este problema afecta a la funci\u00f3n websReadEvent del archivo /goform/GetIPTV. La manipulaci\u00f3n del argumento Content-Length provoca la desreferenciaci\u00f3n de puntero nulo. El ataque puede iniciarse de forma remota. El exploit se ha hecho p\u00fablico y puede utilizarse."
2024-10-23 16:03:56 +00:00
}
] ,
"metrics" : {
"cvssMetricV40" : [
{
"source" : "cna@vuldb.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "4.0" ,
"vectorString" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 7.1 ,
"baseSeverity" : "HIGH" ,
2024-10-23 16:03:56 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"attackRequirements" : "NONE" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "NONE" ,
"vulnerableSystemConfidentiality" : "NONE" ,
"vulnerableSystemIntegrity" : "NONE" ,
"vulnerableSystemAvailability" : "HIGH" ,
"subsequentSystemConfidentiality" : "NONE" ,
"subsequentSystemIntegrity" : "NONE" ,
"subsequentSystemAvailability" : "NONE" ,
"exploitMaturity" : "NOT_DEFINED" ,
"confidentialityRequirements" : "NOT_DEFINED" ,
"integrityRequirements" : "NOT_DEFINED" ,
"availabilityRequirements" : "NOT_DEFINED" ,
"modifiedAttackVector" : "NOT_DEFINED" ,
"modifiedAttackComplexity" : "NOT_DEFINED" ,
"modifiedAttackRequirements" : "NOT_DEFINED" ,
"modifiedPrivilegesRequired" : "NOT_DEFINED" ,
"modifiedUserInteraction" : "NOT_DEFINED" ,
"modifiedVulnerableSystemConfidentiality" : "NOT_DEFINED" ,
"modifiedVulnerableSystemIntegrity" : "NOT_DEFINED" ,
"modifiedVulnerableSystemAvailability" : "NOT_DEFINED" ,
"modifiedSubsequentSystemConfidentiality" : "NOT_DEFINED" ,
"modifiedSubsequentSystemIntegrity" : "NOT_DEFINED" ,
"modifiedSubsequentSystemAvailability" : "NOT_DEFINED" ,
"safety" : "NOT_DEFINED" ,
"automatable" : "NOT_DEFINED" ,
"recovery" : "NOT_DEFINED" ,
"valueDensity" : "NOT_DEFINED" ,
"vulnerabilityResponseEffort" : "NOT_DEFINED" ,
2024-12-08 03:06:42 +00:00
"providerUrgency" : "NOT_DEFINED"
2024-10-23 16:03:56 +00:00
}
}
] ,
"cvssMetricV31" : [
2024-11-01 15:03:21 +00:00
{
2024-12-08 03:06:42 +00:00
"source" : "cna@vuldb.com" ,
"type" : "Secondary" ,
2024-11-01 15:03:21 +00:00
"cvssData" : {
"version" : "3.1" ,
2024-12-08 03:06:42 +00:00
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" ,
"baseScore" : 6.5 ,
"baseSeverity" : "MEDIUM" ,
2024-11-01 15:03:21 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
2024-12-08 03:06:42 +00:00
"privilegesRequired" : "LOW" ,
2024-11-01 15:03:21 +00:00
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "HIGH"
2024-11-01 15:03:21 +00:00
} ,
2024-12-08 03:06:42 +00:00
"exploitabilityScore" : 2.8 ,
2024-11-01 15:03:21 +00:00
"impactScore" : 3.6
} ,
2024-10-23 16:03:56 +00:00
{
2024-12-08 03:06:42 +00:00
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
2024-10-23 16:03:56 +00:00
"cvssData" : {
"version" : "3.1" ,
2024-12-08 03:06:42 +00:00
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"baseScore" : 7.5 ,
"baseSeverity" : "HIGH" ,
2024-10-23 16:03:56 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
2024-12-08 03:06:42 +00:00
"privilegesRequired" : "NONE" ,
2024-10-23 16:03:56 +00:00
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "HIGH"
2024-10-23 16:03:56 +00:00
} ,
2024-12-08 03:06:42 +00:00
"exploitabilityScore" : 3.9 ,
2024-10-23 16:03:56 +00:00
"impactScore" : 3.6
}
] ,
"cvssMetricV2" : [
{
"source" : "cna@vuldb.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:S/C:N/I:N/A:C" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 6.8 ,
2024-10-23 16:03:56 +00:00
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "SINGLE" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "COMPLETE"
2024-10-23 16:03:56 +00:00
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 8.0 ,
"impactScore" : 6.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "cna@vuldb.com" ,
2024-12-15 03:03:56 +00:00
"type" : "Primary" ,
2024-10-23 16:03:56 +00:00
"description" : [
{
"lang" : "en" ,
"value" : "CWE-476"
}
]
}
] ,
2024-11-01 15:03:21 +00:00
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac15_firmware:15.03.05.18:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "56881C41-A993-45CC-BAE6-E9DE17FA56E2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac15_firmware:15.03.05.19:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A14A19EE-FB4E-4371-AC85-1401EB78B16D"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac15:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B73E7C1C-F121-486A-8B15-E97EA0C219A5"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac7_firmware:15.03.06.44:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4D94B37C-491D-4E7C-8273-F46FEDA62C9F"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac7:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A3BEE979-5BF3-48ED-AF42-0546D4F896E9"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac10u_firmware:15.03.06.48:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "1C2AFD04-833D-4085-BAD6-32A2715FA785"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac10u_firmware:15.03.06.49:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0F101E88-BEA9-4017-9048-860DF3D1BBBC"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac10u:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CDBE5E26-7967-4FDD-A29F-7740B29C4B8E"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac500_firmware:1.0.0.14:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "61BA4026-93A8-4D83-815E-397A2EC0A279"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac500_firmware:1.0.0.16:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "816A7A37-5952-4B22-80F7-8CD09383E079"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac500_firmware:2.0.1.9\\(1307\\):*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2F0EEFAB-B3B0-4C10-A712-7A35F5FD076E"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac500:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "64192A8B-CC65-44EC-942B-CC16AADF0D69"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac18_firmware:15.03.05.05:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4D5CB727-FC6B-4212-A61E-2888A0DADFB0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac18_firmware:15.03.05.19\\(6318\\):*:*:*:*:*:*:*" ,
"matchCriteriaId" : "3AC468E5-44D1-4B94-B308-C1025DB1BB7B"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CF9F8AF9-F921-4348-922B-EE5E6037E7AC"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac9_firmware:15.03.2.13:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "3473D6FD-4D42-46D0-9D96-F95D6D856E8E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac9_firmware:15.03.05.14:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "DA7503C5-02C6-4016-A4C6-414146719BFF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac9_firmware:15.03.05.19\\(6318\\):*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D8F25141-8B57-463D-AB97-F52C0143973C"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac9:1.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "566DA530-18FC-4A46-95B4-2A7D343A96A7"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac9_firmware:15.03.06.42:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5B0A5168-9E0C-43F7-BF7B-3943A3316CB8"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac9:3.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7F482F89-B0F6-450D-B675-43EC0A9E6A4B"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac1206_firmware:15.03.06.23:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "787A50A1-EDBC-44EB-8CF2-11C4FC63719D"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac1206:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "29D5013D-520A-461A-95FF-43B2BE160F91"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac6_firmware:15.03.06.23:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D82FD30C-AF3C-4E3B-B674-002A5C9ED09D"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac6:2.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E382AD7E-1450-40FC-AE9D-698B491805F0"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac10_firmware:16.03.10.13:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "6F1C8715-D7B4-4D1A-9E90-079C72049332"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac10_firmware:16.03.10.20:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A19C486B-52A3-4C3E-851D-F349E8E0A706"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac10:4.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "970AEBF4-2B32-4633-A75B-2D2C598C048D"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac10_firmware:16.03.48.19:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "DABA74C0-297A-4372-B84D-00BA0D334318"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac10_firmware:16.03.48.23:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "AC3020CA-7422-4B9A-AA7B-C2B1A03A4450"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac10:5.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2BCFFBD6-3DAD-4FEA-9B5D-D7CBFC36572D"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac8_firmware:16.03.34.06:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "9C1D64DC-1EDC-4F62-8D22-E1890B71843C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:tenda:ac8_firmware:16.03.34.09:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "EE69F412-6FC7-470D-BC7E-B3AAC6B4585F"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:tenda:ac8:4.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "655619B2-6E8B-4D2E-98E7-028E69597E80"
}
]
}
]
}
] ,
2024-10-23 16:03:56 +00:00
"references" : [
{
"url" : "https://github.com/JohenanLi/router_vuls/blob/main/websReadEvent/websReadEvent.md" ,
2024-11-01 15:03:21 +00:00
"source" : "cna@vuldb.com" ,
"tags" : [
"Third Party Advisory"
]
2024-10-23 16:03:56 +00:00
} ,
{
"url" : "https://vuldb.com/?ctiid.281555" ,
2024-11-01 15:03:21 +00:00
"source" : "cna@vuldb.com" ,
"tags" : [
"Permissions Required" ,
"VDB Entry"
]
2024-10-23 16:03:56 +00:00
} ,
{
"url" : "https://vuldb.com/?id.281555" ,
2024-11-01 15:03:21 +00:00
"source" : "cna@vuldb.com" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
2024-10-23 16:03:56 +00:00
} ,
{
"url" : "https://vuldb.com/?submit.426417" ,
2024-11-01 15:03:21 +00:00
"source" : "cna@vuldb.com" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
2024-10-23 16:03:56 +00:00
} ,
{
"url" : "https://www.tenda.com.cn/" ,
2024-11-01 15:03:21 +00:00
"source" : "cna@vuldb.com" ,
"tags" : [
"Product"
]
2024-10-23 16:03:56 +00:00
}
]
}
