CVE-2024-2811 is a High severity (CVSS 8.8) stack-based buffer overflow in the formWifiWpsStart function of Tenda AC15 firmware, reachable through /goform/WifiWpsStart. The record lists no fixed version and says the vendor did not respond to disclosure. Limit who can reach the admin interface and watch Tenda for new firmware.
What's affected
- Product: Tenda AC15 (hardware and firmware).
- Affected firmware per the record: 15.03.05.20_multi (CPE data); the description text says 15.03.20_multi and classified.
- Fixed version: none listed in the record. The VulDB text in the record adds that the vendor was contacted early and did not respond.
- Weakness: stack-based buffer overflow, filed as CWE-121.
- Access needed: a low privilege account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The record describes the flaw as being in formWifiWpsStart, in the file /goform/WifiWpsStart, through the index parameter. VulDB tracks it as VDB-257666.
Severity note: the VulDB wording in the record calls this issue critical, while the CVSS 3.1 base score in the same record is 8.8 (High). Both are in the record, so use the score for triage and treat the wording as the researcher's own label.
How to check if you're exposed
There is no package manager involved, so the check is about the device itself.
- Find the firmware version in the router's administration interface (usually on a status or system page; labels vary by firmware). Compare it with the list above: 15.03.05.20_multi.
- Note whether the admin interface answers from outside your network. From a machine on the internet side of the router, try the router's public address on its web ports. From inside,
nmap -p 80,443,8080 192.168.0.1shows which of those respond (replace the address with your router's). - List every Tenda device you own, including spares and branch office units, since firmware versions are easy to forget.
The advisory pages for this CVE were not available to us, so confirm model and firmware details against the GitHub write up reference in the sources below.
What to do now
- Confirm the model and firmware version from the admin interface and compare with the affected list.
- Turn off remote (WAN side) administration if it is enabled, and keep the admin page reachable only from a trusted management network.
- Change the admin password to a long unique one and remove accounts you do not use, since the flaw needs a low privilege account.
- Check Tenda's support site for a firmware newer than the affected builds. The record shows none, so do not assume one exists.
- If no fix appears and the router guards anything important, plan to replace it with a model that has an active update track.
Why it matters
A stack-based buffer overflow happens when code copies input into a fixed size buffer on the call stack without checking its length. The extra bytes overwrite neighbouring memory, which can crash the service or, in the worst case, let an attacker change what the program does next.
Embedded web servers on consumer routers are a common home for this bug class. The handler code is usually written in C, runs with high privileges, and is rarely hardened with modern memory protections, so a single unchecked copy can matter a lot.
The affected handler formWifiWpsStart reads the index parameter from the request and passes it to code that, according to the record, does not limit its size. That is the shape of the flaw. Because the vendor has not published a fix according to the record, the practical defence is to shrink who can talk to the interface at all.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Quick check
Is there a patch for CVE-2024-2811?
The record lists no fixed version, and the VulDB note says the vendor did not respond. Check Tenda's support pages for firmware newer than 15.03.05.20_multi, and do not rely on a patch existing.
Can someone reach this from the internet?
The CVSS vector marks the network as the attack path and the record says it may be launched remotely. Whether your device is reachable depends on whether remote administration is enabled. Keep it off.
Sources
Record data and references (listed in the NVD record, not all retrievable when we reviewed this post):
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWifiWpsStart.md
- https://vuldb.com/?ctiid.257666
- https://vuldb.com/?id.257666
Last reviewed: 19 October 2026.
