CVE-2024-3908 is a medium severity command injection in the Tenda AC500 router firmware 2.0.1.9(1307), scored 6.3 by NVD. The record lists no fixed version and says the vendor did not respond to the disclosure. Until Tenda publishes a patch, limit who can reach the management interface and check Tenda's support pages for newer firmware.
What's affected
The record names one product and version: Tenda AC500 firmware 2.0.1.9(1307). The weak code is the function formWriteFacMac behind the web path /goform/WriteFacMac, where the argument mac is passed into an operating system command without safe handling. Other firmware builds of the same model may share the code, but the record does not say so, and Tenda has published no advisory that could tell you either way.
The record states that the vendor was contacted early and did not respond, and that an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not in CISA's Known Exploited Vulnerabilities catalog. The VulDB entry is VDB-261144.
There is no fixed version to list. That is the main point for defenders: you cannot patch your way out of this today, so exposure control carries the weight.
The NVD record is dated 2024-04-17 and carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, a score of 6.3 (Medium). Weakness class: CWE-77.
How to check if you're exposed
Start with the firmware version. Sign in to the router's admin page, open the system or firmware status screen and compare the version string with 2.0.1.9(1307). A match means the vulnerable build is running.
Then check reachability, which decides how much the flaw matters. Ask three questions.
- Is the web management port open to the internet side of the router? Test from a network outside your own, such as a phone on mobile data.
- Is remote web management switched on in the settings?
- Which internal hosts and users can reach the admin page, and do they all need to?
The record rates the attack vector as network and the privileges required as low, so an attacker needs a valid login to the admin interface. That makes weak or default admin passwords part of the exposure.
What to do now
- Inventory every Tenda AC500 unit and note the firmware version on each.
- Turn off remote web management and block the admin port from the internet side.
- Change the admin password to a long unique one, and remove any default credentials.
- Limit admin access to a small management network or a single trusted host.
- Check Tenda's download and support pages for new AC500 firmware, and read the release notes before flashing.
- If the unit sits in a sensitive location and no fix appears, plan to replace it with a supported device.
Why it matters
The weakness is command injection, CWE-77. A web handler takes a value from the request, here the argument mac, and builds a system command from it. If the value is not checked, input can change what the command does. The score is lower than for the memory bugs in this family because the record rates the impact on confidentiality, integrity and availability as low each.
Embedded routers run an old stack with little hardening, so a bug in one admin handler tends to give broad control of the device. A router sits on the edge, sees all traffic and often holds VPN and Wi-Fi secrets. Vendor silence also matters: with no patch, your controls are the only defence.
This is also a pattern worth noticing. Several CVEs in this period describe the same kind of bug in different handlers of the same Tenda product lines, which suggests one fix to a single handler will not clear the others. Check every advisory for your model, not just this one.
Quick check
Is there a patch for CVE-2024-3908?
The record does not list a fixed version and states that the vendor did not respond to the disclosure. Check Tenda's support site for the AC500 and read any firmware notes before relying on a fix.
Is CVE-2024-3908 exploited in the wild?
The record says an exploit has been disclosed publicly, but it does not report exploitation in the wild, and the CVE is not in the CISA KEV catalog. Public details still make attempts more likely, so reduce exposure now.
Sources
Last reviewed: 19 October 2026.
