CVE-2024-4252 is a High (CVSS 8.8) stack based buffer overflow in the Tenda i22, in the formSetUrlFilterRule function. The groupIndex argument is the input that overflows. The record says the vendor did not answer the early disclosure, so it lists no fix. Limit access to the web interface and plan a replacement.
What's affected
- Product: Tenda i22 hardware and firmware 1.0.0.3(4687), per the record's CPE entries.
- Affected function: formSetUrlFilterRule, through the groupIndex argument.
- Fixed version: none on record. The record says the vendor was contacted early and did not respond.
- Severity: High, CVSS 8.8, network reachable with low privileges and no user interaction. The description text calls it "critical" in the VulDB sense, so you may see both labels.
- Exploitation: the KEV flag is false. Unlike its sibling CVE-2024-4251, this record does not say a public exploit was released, though a write-up is linked in the references.
How to check if you're exposed
Open the router admin page and read the firmware string. A device on 1.0.0.3(4687) matches the record. The URL filter feature is where the flaw lives, so note whether anyone has configured URL filtering rules on the unit, but treat the device as exposed whether or not they have.
From outside the LAN, probe the management port to confirm it is closed. Review who holds a login, since the vector needs low privileges.
What to do now
- Inventory every Tenda i22 and capture the firmware build.
- Disable remote administration and verify from an outside address.
- Rotate the admin credentials and remove unused accounts.
- Watch the vendor support page for a firmware release that names this CVE before you trust any fix.
- Where the device guards anything sensitive, plan to replace it with a model that still receives patches.
Why it matters
The record lists CWE-121, CWE-787. Both describe writing past the end of a stack buffer, which can overwrite saved control data and change what the device runs next.
The flaw sits in a settings handler, so reaching it takes a session. That helps, but a router with a weak or reused password gives that session away. The practical defense is to keep the admin page off any network you do not control.
Quick check
Which Tenda i22 firmware is named?
The record names version 1.0.0.3(4687). It does not say whether other builds are affected, so check the vendor.
Does an attacker need to be on my network?
The record says the attack may be launched remotely, and the vector is network based. If the admin page is exposed to the internet, it is reachable from outside.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4252 (published 2024-04-27) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
