CVE-2024-4126

A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. This issue affects the function formSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument manualTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261869 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-121
• CWE-787

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formSetSysTime.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.261869Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.261869Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.317831Third Party Advisory, VDB Entry
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formSetSysTime.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.261869Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.261869Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.317831Third Party Advisory, VDB Entry

Published

Apr 24, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41253goframe v2.7.2 is configured to skip TLS certificate verific…7.1
• CVE-2024-41254An issue was discovered in litestream v0.3.13. The usage of …5.3
• CVE-2024-41255filestash v0.4 is configured to skip TLS certificate verific…7.5
• CVE-2024-41256Default configurations in the ShareProofVerifier function of…5.9
• CVE-2024-41258An issue was discovered in filestash v0.4. The usage of the …5.3
• CVE-2024-41259Use of insecure hashing algorithm in the Gravatar's service …9.1
• CVE-2024-41260A static initialization vector (IV) in the encrypt function …7.5
• CVE-2024-41262mmudb v1.9.3 was discovered to use the HTTP protocol in the …7.4
• CVE-2024-41264An issue discovered in casdoor v1.636.0 allows attackers to …7.5
• CVE-2024-41265A TLS certificate verification issue discovered in cortex v0…7.5
• CVE-2024-4127A vulnerability was found in Tenda W15E 15.11.0.14. It has b…8.8
• CVE-2024-41270An issue discovered in the RunHTTPServer function in Gorush …9.1