CVE-2024-0991 is a high severity stack-based buffer overflow flaw, scored 7.2, in Tenda i6 1.0.0.9(3857). The public record names no fixed version and says the vendor did not respond. Restrict network access to the product, check your installed version against the one named in the record, and watch the vendor or project page for a patch.
What's affected
Affected: Tenda i6 firmware 1.0.0.9(3857). The record's CVSS 3.1 score is 7.2 (high), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The record names the formSetCfm function behind /goform/setcfm and the funcpara1 argument. The weakness is filed as CWE-121, CWE-787.
Fixed version: The record names no fixed version, and it notes that the vendor was contacted early and did not respond. No patched release is confirmed.
The record's kev flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog. One thing to note: the VulDB wording in the description calls the issue critical, while the CVSS score in the record is 7.2, which is high. Treat the numeric score and your own exposure as the guide, and know that both labels exist.
How to check if you're exposed
- Sign in to the device administration page and read the model and firmware version. Compare it with the version above.
- Check whether remote or WAN side administration is turned on. If it is, the interface is reachable from the internet and the risk rises.
- Confirm the model and firmware build in the device administration page, and note whether the web administration interface is reachable from the internet or from untrusted networks. Watch for unexplained restarts of the device, which can indicate crashes of the web service.
- Check the vendor support page for newer firmware for your exact model and hardware revision.
What to do now
- Take the product off the internet if it is exposed. Put it behind a VPN or an allow list of known addresses.
- Restrict access at the network layer to the people and systems that need it.
- Watch the vendor or project page for a fixed release, and apply it when one appears. The record says the vendor did not respond to disclosure, so do not wait on it: plan to replace the product if it handles sensitive data.
- Review logs for the signs above and rotate administrator credentials if you see anything unusual.
- Add the product to your inventory and monitoring so a future fix or advisory reaches you. A free in-browser dependency scan covers the third party packages in software you build, though it does not inspect device firmware.
Why it matters
A stack-based buffer overflow occurs when firmware copies request data into a fixed size buffer on the stack without checking the length. A value longer than the buffer overwrites neighbouring memory. On embedded devices that often means a crash of the web server process, and in the worst case control of execution.
The CVSS vector requires high privileges, which is why the score sits at 7.2 and not higher. The attacker needs a login to the device administration interface first. Default or weak admin passwords on small office and home routers make that condition easier to meet than it sounds.
Consumer and small business network gear often gets few firmware updates. A published flaw can stay open for the life of the device, so the safest assumption is that the device stays exposed until you change something about how it is reachable.
The record states that the exploit has been disclosed to the public. That means details are available to others, not that attacks have been observed. Only CISA KEV or a vendor advisory can say that, and neither does here.
Quick check
Is this CVE exploited in the wild?
The record's kev flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports active exploitation. The record does say a public exploit exists. That is a reason to patch or contain it soon, not a report of attacks.
What if there is no patch?
Reduce exposure. Remove internet access, restrict the network, apply the log and credential checks above, and plan to replace the product if it holds sensitive data.
Sources
- Safeguard Gold entry for CVE-2024-0991, built from the NVD record
- NVD record fields: description, CVSS 3.1 vector, CWE list and CPE product data. I did not fetch the researcher write ups listed in the record, so the details above are limited to what the record states.
Last reviewed: 19 October 2026.
