CVE-2024-2902

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. The manipulation of the argument shareSpeed leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257945 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-290205.3JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitiv CVE-2024-290219.0Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape CVE-2024-290228.8Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versio CVE-2024-290237.2Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are CVE-2024-290245.3JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Inse CVE-2024-290255.3Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2024-290269.1Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a leni CVE-2024-290279.0Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-al CVE-2024-290285.3memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows CVE-2024-290296.1memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows una CVE-2024-29038.8A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function GetParentControlInfo of the CVE-2024-290305.3memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows au