PT-2024-5123 · Tenda · Tenda W30E

Wxhwxhwxh_Tutu · Published 2024-04-25 · Updated 2025-07-15 · CVE-2024-4171

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Tenda W30E versions 1.0 through 1.0.1.25

Description: A critical issue has been found in the function fromWizardHandle of the file /goform/WizardHandle, which is related to a stack-based buffer overflow. The manipulation of the argument PPW can lead to this overflow. It is possible to launch the attack remotely by sending specially crafted POST requests, potentially allowing an attacker to execute arbitrary code. The issue has been publicly disclosed and may be exploited.

Recommendations: For Tenda W30E versions 1.0 through 1.0.1.25, as a temporary workaround, consider disabling the fromWizardHandle function until a patch is available. Restrict access to the /goform/WizardHandle file to minimize the risk of exploitation. Avoid using the PPW argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2024-05670

CVE-2024-4171

Affected Products

Tenda W30E

References · 10

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromWizardHandle.md · Exploit
• https://bdu.fstec.ru/vul/2024-05670 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4171 · Security Note
• https://t.me/cvenotify/78019 · Telegram Post
• https://vuldb.com/?submit.318995 · Note
• https://t.me/cvenotify/129056 · Telegram Post
• https://vuldb.com/?ctiid.261990 · Note
• https://t.me/cvenotify/78032 · Telegram Post
• https://vuldb.com/?id.261990 · Note