CVE-2021-40546 Denial of service in n/a
An authenticated administrator can crash the Tenda AC6 router by sending a long string to the 5G WiFi password parameter.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40546?
CVE-2021-40546 is a medium-severity denial of service vulnerability in Tenda Ac6 Firmware, published on 5 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long string in the wifiPwd_5G parameter to /goform/setWifi.
Weakness: CWE-404
Which versions are affected by CVE-2021-40546?
It affects 1 product.
Products include Tenda Ac6 Firmware.
How do I fix CVE-2021-40546?
No fix has been published for CVE-2021-40546 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-40546 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-40546 exists.
Other vulnerabilities in Tenda Ac6 Firmware
Sources
Also known as GHSA-mf93-hqq3-h8xg.