CVE-2024-3905 is a high severity stack-based buffer overflow in the Tenda AC500 router firmware 2.0.1.9(1307), scored 8.8 by NVD. The record lists no fixed version and says the vendor did not respond to the disclosure. Until Tenda publishes a patch, limit who can reach the management interface and check Tenda's support pages for newer firmware.
What's affected
The record names one product and version: Tenda AC500 firmware 2.0.1.9(1307). The weak code is the function R7WebsSecurityHandler behind the web path /goform/execCommand, where the argument password is handled unsafely. Other firmware builds of the same model may share the code, but the record does not say so, and Tenda has published no advisory that could tell you either way.
The record states that the vendor was contacted early and did not respond, and that an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not in CISA's Known Exploited Vulnerabilities catalog. The VulDB entry is VDB-261141.
There is no fixed version to list. That is the main point for defenders: you cannot patch your way out of this today, so exposure control carries the weight.
The NVD record is dated 2024-04-17 and carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, a score of 8.8 (High). Weakness class: CWE-121, CWE-787.
How to check if you're exposed
Start with the firmware version. Sign in to the router's admin page, open the system or firmware status screen and compare the version string with 2.0.1.9(1307). A match means the vulnerable build is running.
Then check reachability, which decides how much the flaw matters. Ask three questions.
- Is the web management port open to the internet side of the router? Test from a network outside your own, such as a phone on mobile data.
- Is remote web management switched on in the settings?
- Which internal hosts and users can reach the admin page, and do they all need to?
The record rates the attack vector as network and the privileges required as low, so an attacker needs a valid login to the admin interface. That makes weak or default admin passwords part of the exposure.
What to do now
- Inventory every Tenda AC500 unit and note the firmware version on each.
- Turn off remote web management and block the admin port from the internet side.
- Change the admin password to a long unique one, and remove any default credentials.
- Limit admin access to a small management network or a single trusted host.
- Check Tenda's download and support pages for new AC500 firmware, and read the release notes before flashing.
- If the unit sits in a sensitive location and no fix appears, plan to replace it with a supported device.
Why it matters
The weakness is a stack-based buffer overflow, tracked as CWE-121 and CWE-787 in the record. A handler copies the value of the argument password into a fixed size buffer on the stack without checking its length. Data that is too long overwrites neighbouring memory. On devices like this, that can crash the web service or, in the worst case, let an attacker run code on the router.
The record rates it 8.8 with low privileges required, so the attacker needs an admin login first. That is a real barrier but a weak one on small office gear with shared or unchanged passwords. Routers also sit at the network edge, which raises the stakes of any code execution. Because the vendor has not responded, treat the device as exposed until firmware says otherwise.
This is also a pattern worth noticing. Several CVEs in this period describe the same kind of bug in different handlers of the same Tenda product lines, which suggests one fix to a single handler will not clear the others. Check every advisory for your model, not just this one.
Quick check
Is there a patch for CVE-2024-3905?
The record does not list a fixed version and states that the vendor did not respond to the disclosure. Check Tenda's support site for the AC500 and read any firmware notes before relying on a fix.
Is CVE-2024-3905 exploited in the wild?
The record says an exploit has been disclosed publicly, but it does not report exploitation in the wild, and the CVE is not in the CISA KEV catalog. Public details still make attempts more likely, so reduce exposure now.
Sources
Last reviewed: 19 October 2026.
