CVE-2024-10280: tenda ac15 firmware +9 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-10280

CVSS 7.5 · High EPSS 0,80%

Kerentanan NULL Pointer Dereference pada tenda ac15 firmware, tenda ac7 firmware +8 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD: 23 Oktober 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-476: NULL Pointer Dereference
EPSS (30 hari): 0,80% peluang dieksploitasi; lebih tinggi dari 55,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tenda	ac15 firmware	Versi 15.03.05.18
tenda	ac15 firmware	Versi 15.03.05.19
tenda	ac7 firmware	Versi 15.03.06.44
tenda	ac10u firmware	Versi 15.03.06.48
tenda	ac10u firmware	Versi 15.03.06.49
tenda	ac500 firmware	Versi 1.0.0.14
tenda	ac500 firmware	Versi 1.0.0.16
tenda	ac500 firmware	Versi 2.0.1.9(1307)
tenda	ac18 firmware	Versi 15.03.05.05
tenda	ac18 firmware	Versi 15.03.05.19(6318)
tenda	ac9 firmware	Versi 15.03.2.13
tenda	ac9 firmware	Versi 15.03.05.14
tenda	ac9 firmware	Versi 15.03.05.19(6318)
tenda	ac9 firmware	Versi 15.03.06.42
tenda	ac1206 firmware	Versi 15.03.06.23
tenda	ac6 firmware	Versi 15.03.06.23
tenda	ac10 firmware	Versi 16.03.10.13
tenda	ac10 firmware	Versi 16.03.10.20
tenda	ac10 firmware	Versi 16.03.48.19
tenda	ac10 firmware	Versi 16.03.48.23
tenda	ac8 firmware	Versi 16.03.34.06
tenda	ac8 firmware	Versi 16.03.34.09

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/JohenanLi/router_vuls/blob/main/websReadEvent/websReadEvent.md advisory pihak ketiga
https://vuldb.com/?id.281555 advisory pihak ketiga · vdb entry
https://vuldb.com/?submit.426417 advisory pihak ketiga · vdb entry
https://vuldb.com/?ctiid.281555 permissions required · vdb entry
https://www.tenda.com.cn/ product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.