CVE-2024-2894

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. This affects the function formSetQosBand of the file /goform/SetNetControlList. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257937 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Tenda	AC7	15.03.06.44
tenda	ac7_firmware	15.03.06.44

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/formSetQosBand.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.257937Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.257937Third Party Advisory, VDB Entry
https://vuldb.com/?submit.300357Third Party Advisory, VDB Entry
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/formSetQosBand.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.257937Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.257937Third Party Advisory, VDB Entry
https://vuldb.com/?submit.300357Third Party Advisory, VDB Entry

Timeline

Published: Mar 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-289408.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-289418.8Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-289428.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-289438.8Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-289448.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-289458.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-289478.2Improper input validation in kernel mode driver for some Intel(R) Server Board S2600ST Family firmware before version 02.01.0017 may allow a CVE-2024-289488.8Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability. It allows an attacker to partly circumvent the same origin CVE-2024-289496.5Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user pr CVE-2024-28958.8A vulnerability was found in Tenda AC7 15.03.06.44. It has been declared as critical. This vulnerability affects the function formWifiWpsOOB CVE-2024-289506.7Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may allow an authenticated CVE-2024-289517.8in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free.