CVE-2018-14559

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the list parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.

• CWE-119

• https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-02/Tenda.mdExploit, Third Party Advisory
• https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-02/Tenda.mdExploit, Third Party Advisory

Published

Apr 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1455IBM Tivoli Application Dependency Discovery Manager 7.2.2 an…4.3
• CVE-2018-14550An issue has been found in third-party PNM decoding associat…8.8
• CVE-2018-14551The ReadMATImageV4 function in coders/mat.c in ImageMagick 7…
• CVE-2018-14553gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a …7.5
• CVE-2018-14557An issue was discovered on Tenda AC7 devices with firmware t…
• CVE-2018-14558An issue was discovered on Tenda AC7 devices with firmware t…9.8
• CVE-2018-1456IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is v…
• CVE-2018-14562An issue was discovered in libthulac.so in THULAC through 20…
• CVE-2018-14563An issue was discovered in libthulac.so in THULAC through 20…
• CVE-2018-14564An issue was discovered in libthulac.so in THULAC through 20…
• CVE-2018-14565An issue was discovered in libthulac.so in THULAC through 20…
• CVE-2018-14567libxml2 2.9.8, if --with-lzma is used, allows remote attacke…