CVE-2024-2817

A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-352

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/fromSysToolRestoreSet.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257672Permissions Required
• https://vuldb.com/?id.257672Third Party Advisory
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/fromSysToolRestoreSet.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257672Permissions Required
• https://vuldb.com/?id.257672Third Party Advisory

Published

Mar 22, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28164SAP NetWeaver AS Java (CAF - Guided Procedures) allows an un…5.3
• CVE-2024-28165 SAP Business Objects Business Intelligence Platform is vuln…9.3
• CVE-2024-28166SAP BusinessObjects Business Intelligence Platform allows …4.3
• CVE-2024-28167SAP Group Reporting Data Collection does not perform necessa…6.5
• CVE-2024-28168Improper Restriction of XML External Entity Reference ('XXE'…7.5
• CVE-2024-28169Cleartext transmission of sensitive information for some Big…5.4
• CVE-2024-28170Improper access control in Intel(R) RAID Web Console all ver…5.5
• CVE-2024-28171 It is possible to perform a path traversal attack and write…8.1
• CVE-2024-28172Uncontrolled search path for some Intel(R) Trace Analyzer an…7.3
• CVE-2024-28173In JetBrains TeamCity between 2023.11 and 2023.11.4 custom b…4.3
• CVE-2024-28174In JetBrains TeamCity before 2023.11.4 presigned URL generat…5.8
• CVE-2024-28175Argo CD is a declarative, GitOps continuous delivery tool fo…5.4