PT-2024-28836 · Tenda · Tenda Ax12

Published 2024-07-10 · Updated 2025-07-07 · CVE-2024-40412

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Tenda AX12 version 1.0 v22.03.01.46

Description The issue is a stack overflow in the deviceList parameter of the sub 42E410 function.

Recommendations For Tenda AX12 version 1.0 v22.03.01.46, consider disabling the sub 42E410 function or restricting the use of the deviceList parameter until a patch is available.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-40412

Affected Products

Tenda Ax12

References · 10

• https://osv.dev/vulnerability/CVE-2024-40412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40412 · Security Note
• https://static.tenda.com.cn/tdcweb/download/uploadfile/AX12/V22.03.01.46.zip · Note
• https://twitter.com/CVEnew/status/1811322734565364069 · Twitter Post
• ❌ https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX12/1/README.md · Note, Deleted
• https://twitter.com/VulmonFeeds/status/1811107862548017504 · Twitter Post
• https://t.me/cvedetector/547 · Telegram Post
• https://t.me/cvenotify/85699 · Telegram Post
• https://t.me/cvenotify/86248 · Telegram Post
• https://t.me/cvenotify/127855 · Telegram Post