CVE-2024-6189

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda A301 15.13.08.12. It has been classified as critical. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Tenda	A301	15.13.08.12
tenda	a301	15.13.08.12

References

https://military-hail-377.notion.site/Tenda-A301V2-0-stack-overflow-c95f23f03b2b4eb5b8ffd3912e9982fdExploit, Third Party Advisory
https://vuldb.com/?ctiid.269160Permissions Required, VDB Entry
https://vuldb.com/?id.269160Third Party Advisory, VDB Entry
https://vuldb.com/?submit.355264Third Party Advisory, VDB Entry
https://military-hail-377.notion.site/Tenda-A301V2-0-stack-overflow-c95f23f03b2b4eb5b8ffd3912e9982fdExploit, Third Party Advisory
https://vuldb.com/?ctiid.269160Permissions Required, VDB Entry
https://vuldb.com/?id.269160Third Party Advisory, VDB Entry
https://vuldb.com/?submit.355264Third Party Advisory, VDB Entry

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-61909.8A vulnerability was found in itsourcecode Farm Management System 1.0. It has been rated as critical. Affected by this issue is some unknown CVE-2024-61919.8A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the fil CVE-2024-61929.8A vulnerability classified as critical was found in itsourcecode Loan Management System 1.0. This vulnerability affects unknown code of the CVE-2024-61939.8A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unk CVE-2024-61949.8A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown functio CVE-2024-61959.8A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-61969.8A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown f CVE-2024-61977.5libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error CVE-2024-61987.7The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. T CVE-2024-61997.7An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the mod CVE-2024-62005.4HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute CVE-2024-62015.3HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead