{"id":21089,"date":"2025-04-10T22:17:46","date_gmt":"2025-04-10T22:17:46","guid":{"rendered":""},"modified":"2025-05-30T05:35:37","modified_gmt":"2025-05-30T11:35:37","slug":"cve-2024-0535-critical-buffer-overflow-in-tenda-pa6-1-0-1-21","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-0535-critical-buffer-overflow-in-tenda-pa6-1-0-1-21\/","title":{"rendered":"CVE-2024-0535: Critical Buffer Overflow in Tenda PA6 1.0.1.21<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In this blog post, we delve into the intricacies of a critical vulnerability found in Tenda PA6 1.0.1.21, identified as CVE-2024-0535. This vulnerability, with a CVSS Severity Score of 8.8, is notable as it can potentially lead to a full system compromise or data leakage. We will discuss the vulnerability in detail, its potential risks, and how to mitigate it.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE-2024-0535 is a stack-based buffer overflow<\/a> vulnerability affecting the `cgiPortMapAdd` function of the `\/portmap` file in the Tenda PA6’s `httpd` component. The manipulation of the `groupName` argument is the root cause of this vulnerability<\/a>. The exploit can be launched remotely<\/a>, and the details have been made public, adding urgency to the need for a robust solution. The identifier VDB-250705 was assigned to this vulnerability<\/a>.<\/p>\n

It’s important to note that the vendor was contacted regarding this disclosure but did not respond, which means the official patch might not be available yet.<\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n