CVE-2024-0990: high-severity vulnerability in Tenda i6
Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 1.7%
A vulnerability, which was classified as critical, was found in Tenda i6 1.0.0.9(3857). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component httpd. The manipulation of the argument ping1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Tenda · i6Related CVEs — Tenda i6
In the same product, most dangerous first.
CVE-2024-0993HIGHTenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflowEPSS 1.7%CVE-2024-0992HIGHTenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflowEPSS 1.7%CVE-2024-0991HIGHTenda i6 httpd setcfm formSetCfm stack-based overflowEPSS 1.7%CVE-2026-6024MEDIUMTenda i6 HTTP R7WebsSecurityHandlerfunction path traversalEPSS 0.7%