Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4225 State: PUBLISHED Published: 2024-04-30T06:47:30.876Z Last Updated: 2024-08-09T14:43:30.601Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: DPS Telecom Products: NetGuardian DIN Remote Telemetry Unit (RTU) Problem Types: CWE-284 Description: Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit (RTU), by DPS Telecom. Attackers can exploit those security vulnerabilities to perform critical actions such as escalate user's privilege, steal user's credential, Cross Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP
te Scripting (XSS) and Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://govtech-csg.github.io/security-advisories/2024/04/29/CVE-2024-4225.html
CVE ID: CVE-2024-4226 State: PUBLISHED Published: 2024-04-30T01:53:34.277Z Last Updated: 2024-12-04T17:19:41.428Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Users with no permissions can see all users Description: It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.octopus.com/post/2024/SA2024-03/
CVE ID: CVE-2024-4227 State: PUBLISHED Published: 2025-01-15T08:00:24.578Z Last Updated: 2025-01-15T14:46:00.530Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Genivia Products: gSOAP Problem Types: CWE-834 Description: In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/gsoap2/code/HEAD/tree/changelog.md - https://www.genivia.com/advisory.html#Upgrade_recommendation_when_option_-c++11_is_used_to_generate_C++11_source_code
CVE ID: CVE-2024-4228 State: PUBLISHED Published: 2024-06-26T14:28:24.028Z Last Updated: 2024-08-01T20:33:52.991Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Magarsus Consultancy Products: SSO (Single Sign On) Problem Types: CWE-89, CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO (Single Sign On) allows SQL Injection.This i
ufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO (Single Sign On) allows SQL Injection.This issue affects SSO (Single Sign On): from 1.0 before 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0800
CVE ID: CVE-2024-4229 State: PUBLISHED Published: 2024-12-19T07:20:54.952Z Last Updated: 2024-12-19T16:38:12.287Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Edgecross Consortium Products: Edgecross Basic Software for Windows, Edgecross Basic Software for Developers Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if th
us code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than a folder that only users with administrative privilege have permission to modify. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf - https://jvn.jp/vu/JVNVU92857077/index.html
CVE ID: CVE-2024-4230 State: PUBLISHED Published: 2024-12-19T07:23:38.732Z Last Updated: 2024-12-19T16:38:06.221Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Edgecross Consortium Products: Edgecross Basic Software for Windows, Edgecross Basic Software for Developers Problem Types: CWE-73 Description: External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition
malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf - https://jvn.jp/vu/JVNVU92857077/index.html
CVE ID: CVE-2024-4231 State: PUBLISHED Published: 2024-05-10T13:29:46.081Z Last Updated: 2024-08-01T20:33:52.975Z Vendors: Digisol Products: Digisol Router DG-GR1321 Problem Types: CWE-1191 Description: This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system. Additional Analyst Notes: - CISA A
could allow the attacker to access the sensitive information on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158
CVE ID: CVE-2024-4232 State: PUBLISHED Published: 2024-05-10T13:32:08.224Z Last Updated: 2024-08-01T20:33:53.102Z Vendors: Digisol Products: Digisol Router DG-GR1321 Problem Types: CWE-256 Description: This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted
stem. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158
CVE ID: CVE-2024-4233 State: PUBLISHED Published: 2024-05-08T13:19:59.655Z Last Updated: 2024-08-01T20:33:52.986Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Tyche Softwares Products: Print Invoice & Delivery Notes for WooCommerce, Arconix Shortcodes, Arconix FAQ Problem Types: CWE-862 Description: Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3. Additional Analyst Not
through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-delivery-notes/wordpress-print-invoice-delivery-notes-for-woocommerce-plugin-4-8-1-broken-access-control-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/arconix-faq/wordpress-arconix-faq-plugin-1-9-3-broken-access-control-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/arconix-shortcodes/wordpress-arconix-shortcodes-plugin-2-1-10-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-4234 State: PUBLISHED Published: 2024-04-26T12:57:12.988Z Last Updated: 2024-08-01T20:33:52.971Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Sayful Islam Products: Filterable Portfolio Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayful Islam Filterable Portfolio allows Stored XSS.This issue affects Filterable Portfolio: from n/a through 1.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/filterable-portfolio/wordpress-filterable-portfolio-plugin-1-6-4-cross
: - https://patchstack.com/database/vulnerability/filterable-portfolio/wordpress-filterable-portfolio-plugin-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-4235 State: PUBLISHED Published: 2024-04-26T17:31:07.743Z Last Updated: 2024-08-01T20:33:52.931Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N) Vendors: Netgear Products: DG834Gv5 Problem Types: CWE-312 Description: A vulnerability classified as problematic was found in Netgear DG834Gv5 1.6.01.34. This vulnerability affects unknown code of the component Web Management Interface. The manipulation leads to cleartext storage of sensitive information. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-262126 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but di
2126 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262126 - https://vuldb.com/?ctiid.262126 - https://vuldb.com/?submit.319148 - https://netsecfish.notion.site/Netgear-DG834Gv5-Plain-Text-Credentials-Exposure-22e94fe066014490bebd349775d10b27?pvs=4
CVE ID: CVE-2024-4236 State: PUBLISHED Published: 2024-04-26T17:31:09.607Z Last Updated: 2024-08-01T20:33:52.983Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AX1803 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda AX1803 1.0.0.1. This issue affects the function formSetSysToolDDNS of the file /goform/SetDDNSCfg. The manipulation of the argument serverName/ddnsUser/ddnsPwd/ddnsDomain leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262127. NOTE: The vendor was
osed to the public and may be used. The associated identifier of this vulnerability is VDB-262127. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262127 - https://vuldb.com/?ctiid.262127 - https://vuldb.com/?submit.319230 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AX/AX1803/formSetSysToolDDNS.md
CVE ID: CVE-2024-4237 State: PUBLISHED Published: 2024-04-26T19:00:05.084Z Last Updated: 2024-08-01T20:33:53.021Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AX1806 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262128. NOTE: The vendor was contacted early about this disclosure but
used. The identifier of this vulnerability is VDB-262128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262128 - https://vuldb.com/?ctiid.262128 - https://vuldb.com/?submit.319231 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AX/AX1806/R7WebsSecurityHandler.md
CVE ID: CVE-2024-4238 State: PUBLISHED Published: 2024-04-26T20:00:06.759Z Last Updated: 2024-08-01T20:33:53.064Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AX1806 Problem Types: CWE-121 Description: A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262129 was assigned to this vulnerability. NOTE: The vendor was contacted early about
nd may be used. The identifier VDB-262129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262129 - https://vuldb.com/?ctiid.262129 - https://vuldb.com/?submit.319232 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AX/AX1806/formSetDeviceName_devName.md
CVE ID: CVE-2024-4239 State: PUBLISHED Published: 2024-04-26T20:31:05.524Z Last Updated: 2024-08-01T20:33:53.007Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AX1806 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-262130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclo
sed. VDB-262130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262130 - https://vuldb.com/?ctiid.262130 - https://vuldb.com/?submit.319235 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AX/AX1806/formSetRebootTimer.md
CVE ID: CVE-2024-4240 State: PUBLISHED Published: 2024-04-26T20:31:06.864Z Last Updated: 2024-08-01T20:33:52.939Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. This affects the function formQosManageDouble_user. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-262131. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichmen
s contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262131 - https://vuldb.com/?ctiid.262131 - https://vuldb.com/?submit.319822 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W9/formQosManageDouble_auto.md
CVE ID: CVE-2024-4241 State: PUBLISHED Published: 2024-04-26T21:00:05.152Z Last Updated: 2024-08-01T20:33:53.022Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been declared as critical. This vulnerability affects the function formQosManageDouble_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be initiated remotely. The identifier of this vulnerability is VDB-262132. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
ed early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262132 - https://vuldb.com/?ctiid.262132 - https://vuldb.com/?submit.319823 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W9/formQosManageDouble_user.md
CVE ID: CVE-2024-4242 State: PUBLISHED Published: 2024-04-26T21:00:06.782Z Last Updated: 2024-08-01T20:33:53.182Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been rated as critical. This issue affects the function formwrlSSIDget of the file /goform/wifiSSIDget. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but di
ntifier VDB-262133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262133 - https://vuldb.com/?ctiid.262133 - https://vuldb.com/?submit.319824 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W9/formwrlSSIDget.md
CVE ID: CVE-2024-4243 State: PUBLISHED Published: 2024-04-26T21:31:04.545Z Last Updated: 2024-08-01T20:33:53.084Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in Tenda W9 1.0.0.7(4456). Affected is the function formwrlSSIDset of the file /goform/wifiSSIDset. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-262134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did n
4 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262134 - https://vuldb.com/?ctiid.262134 - https://vuldb.com/?submit.319825 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W9/formwrlSSIDset.md
CVE ID: CVE-2024-4244 State: PUBLISHED Published: 2024-04-26T21:31:06.054Z Last Updated: 2024-08-01T20:33:53.169Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda W9 1.0.0.7(4456). Affected by this vulnerability is the function fromDhcpSetSer of the file /goform/DhcpSetSer. The manipulation of the argument dhcpStartIp/dhcpEndIp/dhcpGw/dhcpMask/dhcpLeaseTime/dhcpDns1/dhcpDns2 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262135.
exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262135. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262135 - https://vuldb.com/?ctiid.262135 - https://vuldb.com/?submit.319826 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W9/fromDhcpSetSer.md
CVE ID: CVE-2024-4245 State: PUBLISHED Published: 2024-04-27T07:31:04.745Z Last Updated: 2024-08-01T20:33:53.069Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: i21 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). Affected by this issue is the function formQosManageDouble_user. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The identifier of this vulnerability is VDB-262136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262136 - https://vuldb.com/?ctiid.262136 - https://vuldb.com/?submit.319830 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formQosManageDouble_auto.md
CVE ID: CVE-2024-4246 State: PUBLISHED Published: 2024-04-27T08:31:05.312Z Last Updated: 2024-08-01T20:33:53.283Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: i21 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). This affects the function formQosManageDouble_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The identifier VDB-262137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichme
as contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262137 - https://vuldb.com/?ctiid.262137 - https://vuldb.com/?submit.319831 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formQosManageDouble_user.md
CVE ID: CVE-2024-4247 State: PUBLISHED Published: 2024-04-27T09:31:04.549Z Last Updated: 2024-08-01T20:33:53.099Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: i21 Problem Types: CWE-121 Description: A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. This vulnerability affects the function formQosManage_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be initiated remotely. VDB-262138 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: -
tacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262138 - https://vuldb.com/?ctiid.262138 - https://vuldb.com/?submit.319832 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formQosManage_auto.md