CVE-2024-0539 is a high severity (8.8) stack based buffer overflow in W9. It affects Tenda W9 firmware 1.0.0.7(4456). The record names no fixed version and notes that the vendor did not respond to the researcher. Treat the product as exposed until you confirm the version and restrict who can reach it.
What's affected
- Product and location: Tenda W9 firmware 1.0.0.7(4456), in formQosManage_user of the httpd component.
- The vulnerable parameter is ssidIndex.
- Fixed version: The record names no fixed version and notes that the vendor did not respond to the researcher.
- Severity: NVD scores it 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The disclosure text calls the issue critical, while the NVD score is high. Both figures are shown so you can judge for yourself.
- Published: 2024-01-15.
- The record says the exploit has been disclosed to the public and may be used.
How to check if you're exposed
- Sign in to the device web interface and read the firmware version from the status or system page. Compare it with the version in the record.
- Search your asset inventory for the model name. Devices that were never added to it are the ones most likely to be forgotten.
- From a host outside your management network, confirm the admin page is not reachable. Use your normal scanner or a simple connection test to the web port.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Confirm whether you run the product and which version, using the checks above.
- Look for a vendor update. If none exists, assume the product stays unpatched.
- Keep the web management interface off the internet and off untrusted networks.
- Restrict access to the admin page to a small set of management hosts.
- If the vendor never ships a fix, plan to replace the device.
- Run the free dependency scan at gold.safeguard.sh/scan on projects of yours that bundle similar components, and look the CVE up in the Gold directory.
Why it matters
The weakness is CWE-121, a stack based buffer overflow, which falls under the wider class CWE-787, out of bounds write. A request handler copies a value supplied by the client into a fixed size buffer without checking its length. Data written past the end of the buffer can overwrite memory the program depends on.
On small network devices this class of bug is serious because the web service often runs with high privileges and the device may get no regular updates. The record says the vendor did not respond to the researcher, so you should plan around the device staying unpatched.
The record lists CWE-121, CWE-787 for this CVE and carries no CISA Known Exploited Vulnerabilities flag. The scores in this post come from NVD and may be revised.
Quick check
Is there a patch?
The record names no fixed firmware version and says the vendor did not respond. Check the vendor's download page for newer firmware, and do not assume one exists.
Sources
I did not fetch the pages below, so every statement here comes from the NVD record. The VulDB entry and researcher write ups were not independently confirmed. The record states the vendor was contacted early and did not respond.
- https://github.com/jylsec/vuldb/blob/main/Tenda/W9/4/README.md
- https://vuldb.com/?ctiid.250709
- https://vuldb.com/?id.250709
Last reviewed: 19 October 2026.
