CVE-2024-2899

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257942 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Tenda	AC7	15.03.06.44
tenda	ac7	15.03.06.44

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/fromSetWirelessRepeat.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.257942Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.257942Third Party Advisory, VDB Entry
https://vuldb.com/?submit.300362Third Party Advisory, VDB Entry
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/fromSetWirelessRepeat.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.257942Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.257942Third Party Advisory, VDB Entry
https://vuldb.com/?submit.300362Third Party Advisory, VDB Entry

Timeline

Published: Mar 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-289908.8SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this CVE-2024-289918.0SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerabilit CVE-2024-289928.3The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability a CVE-2024-289938.3The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability a CVE-2024-289957.5SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machi CVE-2024-289967.5The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.CVE-2024-289997.5The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.CVE-2024-29008.8A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of th CVE-2024-290004.3The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-pr CVE-2024-290017.4A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user CVE-2024-290034.8The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requi CVE-2024-290044.3The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privi