CVE-2024-4112 is a high severity stack-based buffer overflow in the Tenda TX9 router, firmware 22.03.02.10. NVD scores it 8.8. The record names no fixed firmware and says Tenda did not respond to the disclosure, so restrict access to the management interface and check Tenda for newer firmware.
What's affected
The record lists Tenda TX9 firmware 22.03.02.10 and the TX9 hardware. The flaw sits in the function sub_42CB94, reached through /goform/SetVirtualServerCfg on the router's built-in web server. The overflow is triggered through the list parameter. NVD describes it as remotely reachable and carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which means network access, low attack complexity and low privileges.
The record and the researcher write-up it points to do not name a patched release. The record also states that the vendor was contacted early and did not reply. That means there is no fixed version we can confirm. Do not assume that a later firmware number fixes this entry until Tenda says so in a release note or advisory.
Weakness classes: CWE-121 (stack-based buffer overflow), CWE-787 (out-of-bounds write). The two entries describe the same underlying fault at different levels of detail.
How to check if you're exposed
Start with the firmware version. In the router's web interface, open the system status or about page and read the version string. If it matches 22.03.02.10 on a Tenda TX9, the record applies.
Then check who can reach the admin interface. From a machine outside your management network, test whether the router answers on its web port:
curl -sI http://ROUTER_ADDRESS/ | head -n 5
Replace ROUTER_ADDRESS with the device address. If you get a response from the internet side, remote management is on and the exposure is real. If it only answers from the LAN, the risk is lower but still includes any compromised device on that network.
What to do now
- List every Tenda TX9 in your estate, with firmware version and location. Small branch offices and home offices are easy to miss.
- Turn off remote web management and block the admin port from the internet at the upstream firewall.
- Limit LAN access to the admin interface to one management host or VLAN.
- Check Tenda's support pages for firmware newer than 22.03.02.10, and read the release notes for this issue before trusting it.
- If no fix appears, plan to replace the device where it protects anything sensitive.
- Record the decision and a review date for this CVE, so the exception does not become permanent.
Why it matters
A stack-based buffer overflow happens when input is copied into a fixed memory buffer on the stack without a length check. On embedded devices like routers the web server often runs with high privilege and without modern memory protections, so a bad input can crash the service or, in the worst case, change what code runs. The record scores confidentiality, integrity and availability impact all as high.
This entry is one of many for the same product family, each in a different /goform handler. That pattern matters for planning: fixing a single handler would not close the others, so wait for a vendor release that addresses the whole set rather than a note about one endpoint. The record does not say this CVE is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. It does say a public write-up exists, which lowers the effort for anyone who wants to try.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track. Router firmware is rarely in a software bill of materials, so keep it in your hardware inventory as well.
Quick check
Is there a fixed firmware for CVE-2024-4112?
Not one we can confirm. The record says the vendor did not respond, and it lists no patched version. Check Tenda's support site and release notes.
Is CVE-2024-4112 exploited in the wild?
The record does not say so and the KEV flag is false. A public write-up exists, so treat it as likely to be tried.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the fix status above comes from the record alone.
Last reviewed: 19 October 2026.
