CVE-2024-46045 identifies a stack overflow vulnerability in the Tenda CH22 router firmware version V1.0.0.6(468), located specifically in the frmL7PlotForm function. Stack overflow vulnerabilities occur when a program writes more data to a buffer located on the stack than it can hold, potentially overwriting adjacent memory and causing unpredictable behavior. In this case, the vulnerability can be triggered by an attacker with local or adjacent network access and low privileges, without requiring user interaction. The vulnerability does not impact confidentiality or integrity but affects availability by potentially causing the router to crash or reboot, resulting in denial of service. The CVSS v3.1 base score is 5.7, reflecting medium severity, with attack vector as adjacent network (AV:A), low attack complexity (AC:L), requiring privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and impact limited to availability (A:H). No known exploits have been reported in the wild, and no patches have been released at the time of publication. The vulnerability is categorized under CWE-120, which is a common weakness enumeration for classic stack-based buffer overflows, often exploitable to cause crashes or, in some cases, code execution. However, no indication of code execution or privilege escalation is provided here. The lack of patches and known exploits suggests that the vulnerability is newly disclosed and requires attention from affected users and vendors.

The primary impact of CVE-2024-46045 is denial of service (DoS) due to the stack overflow causing router crashes or reboots. This can disrupt network connectivity for organizations relying on the Tenda CH22 router, affecting business operations and availability of network services. Since confidentiality and integrity are not impacted, data breaches or unauthorized data modification are not immediate concerns. However, loss of availability in network infrastructure can have cascading effects, especially in environments where these routers serve as critical network gateways or are part of larger managed networks. The requirement for adjacent network access and privileges limits the attack surface somewhat, but insider threats or compromised internal hosts could exploit this vulnerability. The absence of known exploits reduces immediate risk, but the medium severity score and lack of patches mean organizations should proactively mitigate to avoid potential future exploitation. The impact is more significant for small to medium enterprises and home users who may lack robust network segmentation or monitoring.

1. Monitor Tenda’s official channels for firmware updates addressing CVE-2024-46045 and apply patches promptly once available. 2. Implement network segmentation to isolate Tenda CH22 routers from untrusted or less secure network segments, reducing the risk of adjacent network exploitation. 3. Restrict access to router management interfaces to trusted hosts only, using access control lists (ACLs) or firewall rules. 4. Regularly audit and monitor network traffic for unusual patterns or repeated crashes that could indicate exploitation attempts. 5. Consider temporary replacement or upgrade of affected devices in critical environments until a patch is available. 6. Educate network administrators about the vulnerability and ensure privileged accounts are secured with strong authentication to prevent misuse. 7. Employ intrusion detection/prevention systems (IDS/IPS) capable of detecting anomalous traffic targeting router management functions. 8. Maintain up-to-date asset inventories to quickly identify affected devices and prioritize remediation efforts.