CVE-2024-4251 is a High (CVSS 8.8) stack based buffer overflow in the Tenda i21, in the fromDhcpSetSer handler behind /goform/DhcpSetSe. The record says the vendor never responded to the disclosure, so no fixed firmware is on record. Restrict who can reach the admin interface and plan to replace the device if no patch appears.
What's affected
- Product: Tenda i21 hardware and firmware 1.0.0.14(4656), per the CPE entries in the record.
- Affected function: fromDhcpSetSer in the file /goform/DhcpSetSe. The record lists seven DHCP settings parameters as the inputs that trigger the overflow: start and end IP, gateway, mask, lease time and two DNS fields.
- Fixed version: none on record. The record says the vendor was contacted early and did not respond in any way.
- Severity: High, CVSS 8.8. The record's description text calls the issue "critical", which is the VulDB rating, not the CVSS score. Both are worth knowing, and the CVSS vector needs a low privilege login (PR:L).
- Exploitation: the record says an exploit has been disclosed to the public and may be used. The KEV flag is false.
How to check if you're exposed
Log in to the router and read the firmware version on the status or system page. If it reads 1.0.0.14(4656), you are on the version named in the record. Other builds are not mentioned, so do not assume they are safe.
Then check who can reach the admin page. From a machine outside your LAN, confirm that the router's management port does not answer. Also list every account that can log in to the web interface, because the vector needs a login.
What to do now
- Find every Tenda i21 in your inventory and record its firmware build.
- Turn off remote web management on each unit, and confirm it from outside the network.
- Change the admin password to a unique one and remove any shared or default logins.
- Check the Tenda support site for new i21 firmware. The record names none, so treat any claim of a fix as unconfirmed until you see a release note.
- If no fixed firmware exists, schedule a replacement and keep the device off untrusted networks until then.
Why it matters
The record maps this to CWE-121, CWE-787. A stack based buffer overflow happens when the code copies input into a fixed size buffer on the stack without checking the length. The DHCP form fields here feed that copy.
On a router the consequence can be a crash or code execution on a device that sits in front of the whole network. The login requirement narrows the audience, but small office routers often keep weak credentials, so treat that requirement as thin protection.
Quick check
Is there a patch for CVE-2024-4251?
The record names no fixed firmware and says the vendor did not respond. Check the vendor's support page and replace the device if nothing is released.
Is CVE-2024-4251 exploited in the wild?
The record's KEV flag is false, and no page I read says this flaw is exploited in the wild. Check the CISA Known Exploited Vulnerabilities catalog for changes. The record does say a public exploit was disclosed.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4251 (published 2024-04-27) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
