CVE-2024-2558

A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-121
• CWE-787

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formexeCommand.mdBroken Link
• https://vuldb.com/?ctiid.257057Permissions Required, VDB Entry
• https://vuldb.com/?id.257057Permissions Required, Third Party Advisory, VDB Entry
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formexeCommand.mdBroken Link
• https://vuldb.com/?ctiid.257057Permissions Required, VDB Entry
• https://vuldb.com/?id.257057Permissions Required, Third Party Advisory, VDB Entry

Published

Mar 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25573Unsanitized user-supplied data saved in the PingFederate Adm…6.9
• CVE-2024-25574 SQL injection vulnerability exists in GetDIAE_usListParamet…9.8
• CVE-2024-25575A type confusion vulnerability vulnerability exists in the w…8.8
• CVE-2024-25576improper access control in firmware for some Intel(R) FPGA p…7.9
• CVE-2024-25578 MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and …7.8
• CVE-2024-25579OS command injection vulnerability in ELECOM wireless LAN ro…6.8
• CVE-2024-25580An issue was discovered in gui/util/qktxhandler.cpp in Qt be…6.2
• CVE-2024-25581When incoming DNS over HTTPS support is enabled using the ng…7.5
• CVE-2024-25582Module savepoints could be abused to inject references to ma…5.4
• CVE-2024-25583A crafted response from an upstream server the recursor has …7.5
• CVE-2024-25584Dovecot accepts dot LF DOT LF symbol as end of DATA command.…5.3
• CVE-2024-2559A vulnerability classified as problematic has been found in …6.5