CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-4114

Critical Severity
Tenda
SVRS
78/100

CVSSv3
8.8/10

EPSS
0.00855/1

CVE-2024-4114: A critical stack-based buffer overflow vulnerability exists in Tenda TX9 router firmware. This flaw allows remote attackers to execute arbitrary code by manipulating the 'time' argument in the '/goform/PowerSaveSet' endpoint. While the CVSS score is 8.8 indicating high severity, the SOCRadar Vulnerability Risk Score (SVRS) is 78, suggesting this is a serious vulnerability that needs attention. An SVRS score of 78 indicates that, while serious, it is just below the threshold of needing immediate remediation. Successful exploitation could lead to complete system compromise, including data theft and device control. Given that the exploit is public, organizations using affected Tenda TX9 devices should apply mitigations or updates immediately, if they become available. The vendor has not responded to disclosure attempts, increasing the risk for users. This emphasizes the importance of proactive cybersecurity monitoring.

No tags available
CVSS:3.1
AV:N
AC:L
PR:L
UI:N
S:U
C:H
I:H
A:H
2024-04-24

2025-01-27

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-4114 | Tenda TX9 22.03.02.10 /goform/PowerSaveSet sub_42C014 time stack-based overflow
vuldb.com2025-01-28
CVE-2024-4114 | Tenda TX9 22.03.02.10 /goform/PowerSaveSet sub_42C014 time stack-based overflow | A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10. This issue affects the function sub_42C014 of the file /goform/PowerSaveSet. The manipulation of the argument time leads to stack-based buffer overflow. The identification of this vulnerability is <a href="https://vuldb.com/?source_cve.261857
cve-2024-4114
cve
file
gt

Social Media

No tweets found for this CVE

Affected Software

Configuration 1
TypeVendorProduct
OSTendatx9_pro_firmware

References

ReferenceLink
[email protected]https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.md
[email protected]https://vuldb.com/?ctiid.261857
[email protected]https://vuldb.com/?id.261857
[email protected]https://vuldb.com/?submit.317218
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.md
AF854A3A-2127-422B-91AE-364DA2661108https://vuldb.com/?ctiid.261857
AF854A3A-2127-422B-91AE-364DA2661108https://vuldb.com/?id.261857
AF854A3A-2127-422B-91AE-364DA2661108https://vuldb.com/?submit.317218
[email protected]https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.md
[email protected]https://vuldb.com/?ctiid.261857
[email protected]https://vuldb.com/?id.261857
[email protected]https://vuldb.com/?submit.317218
GITHUBhttps://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.md

CWE Details

CWE IDCWE NameDescription
CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-787Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence