CVE-2024-4168

A vulnerability was found in Tenda 4G300 1.01.42. It has been classified as critical. This affects the function sub_4260F0. The manipulation of the argument upfilen leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-261987. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-121
• CWE-787

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_4260F0.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.261987Permissions Required, VDB Entry
• https://vuldb.com/?id.261987Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.318987Third Party Advisory, VDB Entry
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_4260F0.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.261987Permissions Required, VDB Entry
• https://vuldb.com/?id.261987Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.318987Third Party Advisory, VDB Entry

Published

Apr 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41674CKAN is an open-source data management system for powering d…5.3
• CVE-2024-41675CKAN is an open-source data management system for powering d…6.1
• CVE-2024-41676Magento-lts is a long-term support alternative to Magento Co…4.8
• CVE-2024-41677Qwik is a performance focused javascript framework. A potent…6.1
• CVE-2024-41678GLPI is a free asset and IT management software package. An …6.1
• CVE-2024-41679GLPI is a free asset and IT management software package. An …8.8
• CVE-2024-41681A vulnerability has been identified in Location Intelligence…7.5
• CVE-2024-41682A vulnerability has been identified in Location Intelligence…5.3
• CVE-2024-41683A vulnerability has been identified in Location Intelligence…5.3
• CVE-2024-41684This vulnerability exists in SyroTech SY-GPON-1110-WDONT Rou…5.3
• CVE-2024-41685This vulnerability exists in SyroTech SY-GPON-1110-WDONT Rou…7.5
• CVE-2024-41686This vulnerability exists in SyroTech SY-GPON-1110-WDONT Rou…3.3