CVE-2024-0540: medium-severity vulnerability in Tenda W9
Tenda W9 httpd formOfflineSet stack-based overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.8%
A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. Affected is the function formOfflineSet of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Tenda · W9Related CVEs — Tenda W9
In the same product, most dangerous first.
CVE-2024-4240HIGHTenda W9 formQosManageDouble_user stack-based overflowEPSS 1.5%CVE-2024-0538HIGHTenda W9 httpd formQosManage_auto stack-based overflowEPSS 1.4%CVE-2024-0536HIGHTenda W9 httpd setWrlAccessList stack-based overflowEPSS 1.4%CVE-2024-4244HIGHTenda W9 DhcpSetSer fromDhcpSetSer stack-based overflowEPSS 1.3%CVE-2024-4243HIGHTenda W9 wifiSSIDset formwrlSSIDset stack-based overflowEPSS 1.3%CVE-2024-4242HIGHTenda W9 wifiSSIDget formwrlSSIDget stack-based overflowEPSS 1.3%