CVE-2024-2709 is a stack-based buffer overflow in the Tenda AC10U router firmware 15.03.06.49, in the function fromSetRouteStatic of /goform/SetStaticRouteCfg through the list argument, scored High at 8.8. Severity is High at 8.8. No fix is named, and the record says the vendor did not respond to the disclosure.
What's affected
- Tenda AC10U firmware 15.03.06.49 is listed in the record.
- The function is fromSetRouteStatic, the file is /goform/SetStaticRouteCfg and the argument is list.
- The record says the vendor was contacted early and did not respond, and that the exploit has been disclosed to the public and may be used. It does not report attacks in the wild, and the KEV flag is false.
- No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.
The NVD record gives a CVSS score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Published 2024-03-20.
How to check if you're exposed
- Log in to the router's admin page and read the firmware version on the system status page.
- Check that the admin interface is not reachable from the internet. From outside your network, the router's public address should not answer on its admin port.
- Check the Tenda support site for newer AC10U firmware and compare the version.
- See VulDB entry VDB-257460 named in the record.
What to do now
- Find AC10U routers on your network, including remote or branch sites.
- Turn off remote administration, and limit admin access to a wired management host if you can.
- Check the vendor's support page for newer firmware and install it if one is offered.
- Use a strong admin password, since the vector requires a login with low privileges.
- If no fix appears, plan to replace the device.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
A stack-based buffer overflow comes from copying a request value into a fixed size buffer without checking its length. The tagged weaknesses are CWE-121 and CWE-787. The vector needs low privileges, so the attacker must be able to log in to the admin interface, but the impact on confidentiality, integrity and availability is high if the overflow is abused.
Nine memory and command flaws in the same router firmware were published on the same day, so this is a code quality pattern in the web handlers rather than one slip.
The record tags the weakness as CWE-787. See the Gold pages for more on the class.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
The related Tenda AC10U flaws are CVE-2024-2703 to CVE-2024-2711. They affect different handler functions in the same firmware, and CVE-2024-2707 is an OS command injection rather than an overflow.
Quick check
Does the attacker need a login?
The CVSS vector lists low privileges required, so a login to the admin interface is needed. Keep that interface off the internet and use a strong password.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
