CVE-2024-0537

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in Tenda W9 1.0.0.7(4456). This affects the function setWrlBasicInfo of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250707. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Tenda	W9	1.0.0.7(4456)
tenda	w9_firmware	1.0.0.7\(4456\)_cn

References

https://github.com/jylsec/vuldb/blob/main/Tenda/W9/2/README.mdBroken Link, Third Party Advisory
https://vuldb.com/?ctiid.250707Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.250707Permissions Required, Third Party Advisory, VDB Entry
https://github.com/jylsec/vuldb/blob/main/Tenda/W9/2/README.mdBroken Link, Third Party Advisory
https://vuldb.com/?ctiid.250707Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.250707Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: Jan 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-05389.8A vulnerability has been found in Tenda W9 1.0.0.7(4456) and classified as critical. This vulnerability affects the function formQosManage_a CVE-2024-05399.8A vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical. This issue affects the function formQosManage_user of the co CVE-2024-05409.8A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. Affected is the function formOfflineSet of the comp CVE-2024-05419.8A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been declared as critical. Affected by this vulnerability is the function formAd CVE-2024-05429.8A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been rated as critical. Affected by this issue is the function formWifiMacFilter CVE-2024-05437.5A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. This affects an unknown part of CVE-2024-05456.1A vulnerability classified as problematic was found in CodeCanyon RISE Ultimate Project Manager 3.5.3. This vulnerability affects unknown co CVE-2024-05467.5A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the com CVE-2024-05477.5A vulnerability has been found in Ability FTP Server 2.34 and classified as problematic. Affected by this vulnerability is an unknown functi CVE-2024-05487.5A vulnerability was found in FreeFloat FTP Server 1.0 and classified as problematic. Affected by this issue is some unknown functionality of CVE-2024-05498.1mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to CVE-2024-05506.5A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then u