CVE-2024-51315
A critical stack overflow vulnerability exists in the Tenda TX9 router firmware version V22.03.02.20. The flaw is in the /goform/SetOnlineDevName handler and can be triggered remotely without authentication. An attacker could potentially take control of the device.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Tenda TX9 router, firmware V22.03.02.20.
Real-world impact
An attacker could execute arbitrary code on the router, potentially taking full control, intercepting traffic, or using the device as part of a botnet.
Why this severity
The CVSS score of 9.8 reflects the vulnerability's remote exploitability, lack of authentication, and the ability to compromise confidentiality, integrity, and availability.
What to do about it
- ›Avoid using the vulnerable firmware version; if a newer firmware is available, upgrade the router. If no update is available, consider disabling the affected feature or replacing the device.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources