CVE-2018-14492

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-21 · updated 2026-06-17
Weakness: CWE-787

Description

Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.

Affected products

Tendacn Ac10 Firmware: through 15.03.06.23_cn
Tendacn Ac15 Firmware: through 15.03.05.19_cn
Tendacn Ac18 Firmware: through 15.03.05.19\(6318\)_cn
Tendacn Ac7 Firmware: through 15.03.06.44_cn
Tendacn Ac9 Firmware: through v15.03.05.19\(6318\)_cn

References

https://github.com/ZIllR0/Routers/blob/master/Tendaoob1.md
https://github.com/ZIllR0/Routers/blob/master/Tendaoob1.md

Get alerted when CVE-2018-14492 or the next vulnerability affects your stack