CVE-2024-51314

CriticalCVSS 9.8/10Last modified Jul 21, 2026

Description

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2026
Last modified
Jul 21, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-513159.8The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevNameCVE-2024-513167.5The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevNaCVE-2024-513176.5An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize functionCVE-2024-513197.3A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve RemotCVE-2024-513205.4Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via thCVE-2024-513217.6In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlCVE-2024-513225.4Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via thCVE-2024-513243.8An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (BriCVE-2024-513267.5SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2' CVE-2024-513279.8SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL InjeCVE-2024-513286.1Cross Site Scripting vulnerability in addcategory.php in projectworld's Travel Management System v1.0 allows remote attacker to inject arbitCVE-2024-513298.8A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a cra
CVE-2024-51314: Critical severity, CVSS 9.8 | Vulnix