CVE-2024-51311
A stack overflow flaw exists in the Tenda TX9 router’s firmware (V22.03.02.05) within the /goform/SetNetControlList handler. The bug can be triggered over the network and may allow an attacker to execute arbitrary code on the device. The vulnerability is rated critical.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Tenda TX9 routers running firmware version V22.03.02.05 (and potentially earlier builds that contain the same code).
Real-world impact
An attacker who can reach the router’s web interface could exploit the overflow to run malicious code, potentially taking full control of the device, intercepting traffic, or using it as part of a botnet.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑based, requires no user interaction, and grants an attacker complete compromise of confidentiality, integrity, and availability. The low attack complexity and lack of required privileges further raise the score.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources