CVE-2023-50991 is a high severity (CVSS 7.5) buffer overflow in the pingSet function of Tenda i29 firmware 1.0.0.2 and 1.0.0.5. A remote attacker can cause a denial of service through the pingIp parameter. The record names no fix, so contact Tenda and limit exposure of the management interface.
What's affected
The record lists Tenda i29 hardware version 1.0 with firmware V1.0.0.2 and V1.0.0.5. The description says a remote attacker can cause a denial of service through the pingIp parameter in the pingSet function. The only reference is a researcher write-up on GitHub.
The record names no fixed version and I did not find a vendor advisory in the references, so check with the vendor directly for a patched release. Treat any i29 running those two firmware builds as affected until the vendor says otherwise.
CVSS for this entry is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
How to check if you're exposed
Log in to the device's administration page and read the firmware version on the status or system page. If it reads V1.0.0.2 or V1.0.0.5, it matches the record.
Then ask a more useful question: can anyone reach that administration interface from an untrusted network? The NVD vector shows no privileges and no user interaction, so reachability is what decides your real exposure.
What to do now
- List every Tenda i29 in your estate and note the firmware build.
- Contact Tenda support for a patched firmware and ask for their advisory reference.
- Make sure the web management interface is not reachable from the internet or from guest networks.
- Plan for replacement if the vendor has no fix, and note the device in your risk register meanwhile.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-120 is a classic buffer copy without checking the size of the input. Data larger than the destination overwrites adjacent memory. The fix is to check lengths before copying, or to use APIs that enforce bounds.
Buffer overflows happen when a program copies input into a fixed-size space without checking the length. Here the impact in the record is availability only: the device can be knocked offline. The NVD vector has no confidentiality or integrity impact.
A router or access device that crashes on demand is still a business problem, because everything behind it loses connectivity. Embedded firmware also tends to be patched slowly, which makes network placement the practical control.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Does this allow code execution?
The record only describes denial of service. It does not claim code execution.
Is there a patch?
The record names none. Ask Tenda and check their site for firmware newer than V1.0.0.5.
Sources
Last reviewed: 19 October 2026.
