CVE-2024-10280

🗓️ 23 Oct 2024 13:31:07Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

Vulnerability in Tenda routers AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500, and AC1206 allows remote null pointer dereference

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the websReadEvent function in the microprogrammed routing software Tenda AC allows a hacker to execute arbitrary code.	6 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-10280	23 Oct 202417:23	–	circl
CNNVD	Tenda多款产品代码问题漏洞	23 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-10280 Tenda AC6/AC7/AC8/AC9/AC10/AC10U/AC15/AC18/AC500/AC1206 GetIPTV websReadEvent null pointer dereference	23 Oct 202413:31	–	cvelist
EUVD	EUVD-2024-33008	3 Oct 202520:07	–	euvd
NVD	CVE-2024-10280	23 Oct 202414:15	–	nvd
OSV	CVE-2024-10280	23 Oct 202414:15	–	osv
Positive Technologies	PT-2024-9134 · Tenda · Tenda Ac1206 +8	23 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-10280	23 May 202510:42	–	redhatcve
Vulnrichment	CVE-2024-10280 Tenda AC6/AC7/AC8/AC9/AC10/AC10U/AC15/AC18/AC500/AC1206 GetIPTV websReadEvent null pointer dereference	23 Oct 202413:31	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

AND

tenda ac15_firmwareMatch15.03.05.18

tenda ac15_firmwareMatch15.03.05.19

tenda ac15Match-

Node

AND

tenda ac7_firmwareMatch15.03.06.44

tenda ac7Match-

Node

AND

tenda ac10u_firmwareMatch15.03.06.48

tenda ac10u_firmwareMatch15.03.06.49

tenda ac10uMatch-

Node

AND

tenda ac500_firmwareMatch1.0.0.14

tenda ac500_firmwareMatch1.0.0.16

tenda ac500_firmwareMatch2.0.1.9(1307)

tenda ac500Match-

Node

AND

tenda ac18_firmwareMatch15.03.05.05

tenda ac18_firmwareMatch15.03.05.19(6318)

tenda ac18Match-

Node

AND

tenda ac9_firmwareMatch15.03.2.13

tenda ac9_firmwareMatch15.03.05.14

tenda ac9_firmwareMatch15.03.05.19(6318)

tenda ac9Match1.0

Node

AND

tenda ac9_firmwareMatch15.03.06.42

tenda ac9Match3.0

Node

AND

tenda ac1206_firmwareMatch15.03.06.23

tenda ac1206Match-

Node

AND

tenda ac6_firmwareMatch15.03.06.23

tenda ac6Match2.0

Node

AND

tenda ac10_firmwareMatch16.03.10.13

tenda ac10_firmwareMatch16.03.10.20

tenda ac10Match4.0

Node

AND

tenda ac10_firmwareMatch16.03.48.19

tenda ac10_firmwareMatch16.03.48.23

tenda ac10Match5.0

Node

AND

tenda ac8_firmwareMatch16.03.34.06

tenda ac8_firmwareMatch16.03.34.09

tenda ac8Match4.0

[
  {
    "vendor": "Tenda",
    "product": "AC6",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC7",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC8",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC9",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC10",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC10U",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC15",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC18",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC500",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Tenda",
    "product": "AC1206",
    "versions": [
      {
        "version": "20241022",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/JohenanLi/router_vuls/blob/main/websReadEvent/websReadEvent.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
tenda	www.tenda.com.cn/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
Content-Length	header	/goform/GetIPTV	Null pointer dereference caused by manipulation of Content-Length in GetIPTV (CVE-2024-10280, CWE-476).	CWE-476

17 Jun 2026 06:55Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.5 - 7.5

CVSS 26.8

CVSS 47.1

CVSS 36.5

EPSS0.00755

SSVC

CWE-476