CVE-2024-51311
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.05 in the sub_4418CC function of the /goform/SetNetControlList file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
Risk Assessment
The risk for the organization includes potential takeover of the Tenda TX9 router, leading to network data confidentiality and integrity breaches, as well as network disruption.
Recommendation
It is recommended to immediately update the Tenda TX9 firmware to the latest version if available, or apply temporary mitigations such as restricting access to the management interface.
Other vulnerabilities in Tenda TX9
See all- CVE-2024-51315Critical
A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 in the sub_425964 function of the /goform/SetOnlineDevName file. An attacker can remotely exploit this flaw to execute arbitrary code.
- CVE-2024-51314Critical
A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 within the sub_424CE0 function of the /goform/setMacFilterCfg file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2024-51312Critical
A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EEE0 function of the /goform/SetStaticRouteCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a device crash.
- CVE-2024-51313Critical
A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EA38 function of the /goform/SetVirtualServerCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2024-51316High
Denial of service (DoS) vulnerability in Tenda TX9 firmware version V22.03.02.20 in the update_dev_name function of the file /goform/SetOnlineDevName. The attack can cause device unavailability.
Original NVD description (English source)
The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList.