CVE-2024-4114

A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10. This issue affects the function sub_42C014 of the file /goform/PowerSaveSet. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-121
• CWE-787

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.mdBroken Link
• https://vuldb.com/?ctiid.261857Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.261857Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.317218Third Party Advisory, VDB Entry
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.mdBroken Link
• https://vuldb.com/?ctiid.261857Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.261857Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.317218Third Party Advisory, VDB Entry

Published

Apr 24, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41133A vulnerability exists in the HPE Aruba Networking EdgeConne…7.2
• CVE-2024-41134A vulnerability exists in the HPE Aruba Networking EdgeConne…7.2
• CVE-2024-41135A vulnerability exists in the HPE Aruba Networking EdgeConne…7.2
• CVE-2024-41136An authenticated command injection vulnerability exists in t…8.8
• CVE-2024-41138A library injection vulnerability exists in the com.microsof…9.8
• CVE-2024-41139Incorrect privilege assignment vulnerability exists in SKYSE…7.8
• CVE-2024-41140Zohocorp ManageEngine Applications Manager versions 174000 a…6.5
• CVE-2024-41141Stored cross-site scripting vulnerability exists in EC-CUBE …6.1
• CVE-2024-41143Origin validation error vulnerability exists in SKYSEA Clien…7.8
• CVE-2024-41144Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <=…7.1
• CVE-2024-41145A library injection vulnerability exists in the WebView.app …9.8
• CVE-2024-41146Use of Multiple Resources with Duplicate Identifier (CWE-694…4.6