CVE-2024-4169

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda 4G300 1.01.42. It has been declared as critical. This vulnerability affects the function sub_42775C/sub_4279CC. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The identifier of this vulnerability is VDB-261988. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Tenda	4G300	1.01.42
tenda	4g300	1.01.42

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_42775C.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.261988Permissions Required, VDB Entry
https://vuldb.com/?id.261988Third Party Advisory, VDB Entry
https://vuldb.com/?submit.318988Third Party Advisory, VDB Entry
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_42775C.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.261988Permissions Required, VDB Entry
https://vuldb.com/?id.261988Third Party Advisory, VDB Entry
https://vuldb.com/?submit.318988Third Party Advisory, VDB Entry

Timeline

Published: Apr 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-416904.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext wit CVE-2024-416914.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root file CVE-2024-416928.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper CVE-2024-416936.1Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-416945.3Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-416957.5Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVE-2024-416967.5Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-416976.1Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-416987.5Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-416997.5Priority – CWE-552: Files or Directories Accessible to External Parties CVE-2024-41708.8A vulnerability was found in Tenda 4G300 1.01.42. It has been rated as critical. This issue affects the function sub_429A30. The manipulatio CVE-2024-417007.5Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor