CVE-2024-2808

A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This issue affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-121

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formQuickIndex.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257663Permissions Required
• https://vuldb.com/?id.257663Third Party Advisory
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formQuickIndex.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257663Permissions Required
• https://vuldb.com/?id.257663Third Party Advisory

Published

Mar 22, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28072A highly privileged account can overwrite arbitrary files on…4.9
• CVE-2024-28073SolarWinds Serv-U was found to be susceptible to a Directory…7.2
• CVE-2024-28074It was discovered that a previous vulnerability was not comp…8.8
• CVE-2024-28075The SolarWinds Access Rights Manager was susceptible to Remo…8
• CVE-2024-28076The SolarWinds Platform was susceptible to a Arbitrary Open …3.8
• CVE-2024-28077A denial-of-service issue was discovered on certain GL-iNet …7.5
• CVE-2024-28084p2putil.c in iNet wireless daemon (IWD) through 2.15 allows …7.5
• CVE-2024-28085wall in util-linux through 2.40, often installed with setgid…3.3
• CVE-2024-28087In Bonitasoft runtime Community edition, the lack of dynamic…6.5
• CVE-2024-28088LangChain through 0.1.10 allows ../ directory traversal by a…8.1
• CVE-2024-28089Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a …5.2
• CVE-2024-2809A vulnerability, which was classified as critical, was found…9.8