CVE-2024-2488

Summary

CVE-2024-2488 is a newly disclosed critical vulnerability affecting the Tenda AC18 router with firmware version 15.03.05.05. The issue lies within the function formSetPPTPServer of the /goform/SetPptpServerCfg file. An attacker can manipulate the startIP argument, leading to a stack-based buffer overflow. This vulnerability can be exploited remotely, making it a significant security risk. Unfortunately, the exploit has already been made public, increasing the likelihood of attacks. The associated identifier for this vulnerability is VDB-256895. Despite being contacted early about the disclosure, the vendor has not responded.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.