CVE-2024-0931 is a medium severity flaw (CVSS 4.7) in Tenda AC10U. The record says the vendor did not respond, and no fixed firmware is listed. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
Tenda AC10U firmware 15.03.06.49_multi_TDE01, the function saveParentControlInfo, argument deviceId, time and urls.
The record gives a CVSS base score of 4.7 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. The weakness class is CWE-121.
The record scores this 4.7 Medium, which reflects the need for high privileges. It is one of a group of similar stack overflow reports against the same firmware, each in a different handler function, so a fix for one may not cover the others.
The record says exploit details have been disclosed publicly, so assume that attackers can learn how the weakness works. The record says the vendor did not respond, and no fixed firmware is listed. Check the Tenda support page for the AC10U.
How to check if you're exposed
Sign in to the router admin page and read the firmware version under system status. Compare with 15.03.06.49_multi_TDE01.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0931 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of Tenda AC10U in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record says the vendor did not respond, and no fixed firmware is listed.
- Apply mitigations while you wait: turn off remote web management, restrict the admin interface to a trusted host, and ask Tenda for a firmware update.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is a stack-based buffer overflow. A function copies a request value into a fixed size buffer on the stack without checking its length, so an oversized value overwrites neighbouring memory. At minimum the web service crashes. Depending on the device and its protections, memory corruption can be more serious than a crash.
Embedded firmware often lacks the exploit mitigations that desktop systems take for granted, which is why this class matters even when the scoring looks moderate. The reliable fix is a firmware update that checks lengths before copying. Without one, reducing who can reach the web interface is the main control.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
Does a Medium score mean I can ignore it?
No. The score reflects needed privileges. Memory corruption bugs on embedded devices deserve a plan, even if the plan is isolation.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record says the vendor did not respond, and no fixed firmware is listed. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/saveParentControlInfo_1.md
- https://vuldb.com/?ctiid.252136
- https://vuldb.com/?id.252136
- Safeguard Gold record for CVE-2024-0931
Last reviewed: 19 October 2026.
