← Security Alerts

CVE-2024-10280

Tenda · published 2024-10-23

Source record Collected from the National Vulnerability Database (NVD)

Description

Description by VulDB via the CVE Program.

A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Filed by VulDB; not a statement by Tenda.

Status at the source

Affected products, as the source lists them

VendorProductVersions
TendaAC620241022: affected
TendaAC720241022: affected
TendaAC820241022: affected
TendaAC920241022: affected
TendaAC1020241022: affected
TendaAC10U20241022: affected
TendaAC1520241022: affected
TendaAC1820241022: affected
TendaAC50020241022: affected
TendaAC120620241022: affected

Added by CISA-ADP (Authorized Data Publisher)

VendorProductVersions
tendaac6_firmware15.03.06.23: affected
tendaac8_firmware16.03.34.06: affected
tendaac8_firmware16.03.34.09: affected
tendaac10_firmware16.03.48.23: affected
16.03.48.19: affected
16.03.48.20: affected
16.03.48.13: affected
tendaac1206_firmware15.03.06.23: affected
tendaac9_firmware15.03.06.42: affected
15.03.05.19\(6318_\): affected
15.03.05.14: affected
15.03.2.13: affected
tendaac18_firmware15.03.05.05: affected
tendaac18_firmware15.03.05.19\(6318\): affected
tendaac500_firmware2.0.1.9\(1307\): affected
tendaac500_firmware1.0.0.16: affected
tendaac500_firmware1.0.0.14: affected
tendaac10u_firmware15.03.06.48: affected
tendaac10u_firmware15.03.06.49: affected
tendaac7_firmware15.03.06.44: affected
tendaac15_firmware15.03.05.18: affected
tendaac15_firmware15.03.05.19: affected
Products named in NVD's CPE match criteria (10)
  • cpe:2.3:o:tenda:ac15_firmware:15.03.05.18:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac7_firmware:15.03.06.44:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac10u_firmware:15.03.06.48:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac500_firmware:1.0.0.14:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac18_firmware:15.03.05.05:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac9_firmware:15.03.2.13:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac1206_firmware:15.03.06.23:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac6_firmware:15.03.06.23:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac10_firmware:16.03.10.13:*:*:*:*:*:*:*
  • cpe:2.3:o:tenda:ac8_firmware:16.03.34.06:*:*:*:*:*:*:*

DeSpy has not checked any unit, hardware revision or firmware. A product missing here is not a statement that it is unaffected.

Scores, as their sources published them

DeSpy does not score records. These are the sources' own values.

Weaknesses

CWE-476

Sources

References the source lists

Source dates: published 2024-10-23, last changed 2026-06-17. DeSpy's copy of this version is dated 2026-09-28.

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.

Scope, sources and licences →