CVE-2024-34974 - Vulnerability Details - OpenCVE

Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00148.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Tenda	Ac18 Ac18 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:tenda:ac18_firmware:15.03.05.19:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-35134	Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/hunzi0/Vullnfo/tree/main/Tenda/AC18/formSetPPTPServer

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.0021}`	epss `{'score': 0.00148}`

Mon, 17 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tenda ac18 Firmware
CPEs		cpe:2.3:o:tenda:ac18_firmware:15.03.05.19:::::::*
Vendors & Products		Tenda ac18 Firmware

Tue, 29 Oct 2024 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-121

Tue, 29 Oct 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tenda Tenda ac18
Weaknesses		CWE-125
CPEs		cpe:2.3:h:tenda:ac18:-:::::::*
Vendors & Products		Tenda Tenda ac18
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-05-10T12:29:34.817Z

Updated: 2025-02-13T15:53:49.314Z

Reserved: 2024-05-09T00:00:00.000Z

Link: CVE-2024-34974

Vulnrichment

Updated: 2024-08-02T03:07:46.763Z

NVD

Status : Analyzed

Published: 2024-05-14T15:39:38.873

Modified: 2025-03-17T14:50:09.420

Link: CVE-2024-34974

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-34974", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-13T15:53:49.314Z", "datePublished": "2024-05-10T12:29:34.817Z", "dateReserved": "2024-05-09T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-10T12:29:35.106Z"}, "descriptions": [{"lang": "en", "value": "Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/hunzi0/Vullnfo/tree/main/Tenda/AC18/formSetPPTPServer"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "affected": [{"vendor": "tenda", "product": "ac18", "cpes": ["cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "15.03.05.19", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-10T18:00:03.789166Z", "id": "CVE-2024-34974", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T14:19:03.705Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:07:46.763Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/hunzi0/Vullnfo/tree/main/Tenda/AC18/formSetPPTPServer", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/hunzi0/Vullnfo/tree/main/Tenda/AC18/formSetPPTPServer", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:07:46.763Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-34974", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-10T18:00:03.789166Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:*"], "vendor": "tenda", "product": "ac18", "versions": [{"status": "affected", "version": "15.03.05.19"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-10T18:01:30.523Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/hunzi0/Vullnfo/tree/main/Tenda/AC18/formSetPPTPServer"}], "descriptions": [{"lang": "en", "value": "Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-10T12:29:35.106Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34974", "state": "PUBLISHED", "dateUpdated": "2025-02-13T15:53:49.314Z", "dateReserved": "2024-05-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-05-10T12:29:34.817Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}