CVE-2024-25753

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the formSetDeviceName function.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
tenda	ac9_firmware	3.0

References

https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0218/formSetDeviceName.mdThird Party Advisory
https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0218/formSetDeviceName.mdThird Party Advisory

Timeline

Published: Feb 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-257568.0A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute CVE-2024-25769.8A vulnerability, which was classified as critical, was found in SourceCodester Employee Task Management System 1.0. This affects an unknown CVE-2024-257635.5openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c.CVE-2024-257676.5nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.CVE-2024-257687.5OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c.CVE-2024-25779.8A vulnerability has been found in SourceCodester Employee Task Management System 1.0 and classified as critical. This vulnerability affects CVE-2024-257704.3libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.CVE-2024-25784.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.Thi CVE-2024-25795.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This iss CVE-2024-25806.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allow CVE-2024-258016.1SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not t CVE-2024-258029.8SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the fil