CVE-2021-27706

CWE-120 — Classic Buffer Overflow3 documents3 sources
Severity
9.8CRITICAL
EPSS
3.1%
top 13.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Tenda G1 FirmwareTenda G3 Firmware
Timeline
PublishedApr 14
Latest updateMay 24

Description

Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"IPMacBindIndex "request. This occurs because the "formIPMacBindDel" function directly passes the parameter "IPMacBindIndex" to strcpy without limit.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDtenda/g1_firmwarev15.11.0.17\(9502\)_cn
▶NVDtenda/g3_firmwarev15.11.0.17\(9502\)_cn

🔴Vulnerability Details

2
GHSA
GHSA-2p22-jp73-7gf2: Buffer Overflow in Tenda G1 and G3 routers with firmware version V15↗2022-05-24
▶
CVEList
CVE-2021-27706: Buffer Overflow in Tenda G1 and G3 routers with firmware version V15↗2021-04-14
▶
CVE-2021-27706 (CRITICAL CVSS 9.8) | Buffer Overflow in Tenda G1 and G3 | cvebase.io