CVE-2024-4171

A vulnerability classified as critical has been found in Tenda W30E 1.0/1.0.1.25. Affected is the function fromWizardHandle of the file /goform/WizardHandle. The manipulation of the argument PPW leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-121

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromWizardHandle.mdBroken Link
• https://vuldb.com/?ctiid.261990Permissions Required, VDB Entry
• https://vuldb.com/?id.261990Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.318995Third Party Advisory, VDB Entry
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromWizardHandle.mdBroken Link
• https://vuldb.com/?ctiid.261990Permissions Required, VDB Entry
• https://vuldb.com/?id.261990Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.318995Third Party Advisory, VDB Entry

Published

Apr 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41704LibreChat through 0.7.4-rc1 does not validate the normalized…9.8
• CVE-2024-41705A stored XSS issue was discovered in Archer Platform 6.8 bef…5.4
• CVE-2024-41706A stored XSS issue was discovered in Archer Platform 6 befor…5.4
• CVE-2024-41707An issue was discovered in Archer Platform 6 before 2024.06.…5.4
• CVE-2024-41708An issue was discovered in AdaCore ada_web_services 20.0 all…7.5
• CVE-2024-41709Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not…4.8
• CVE-2024-41710A vulnerability in the Mitel 6800 Series, 6900 Series, and 6…7.2
• CVE-2024-41711A vulnerability in the Mitel 6800 Series, 6900 Series, and 6…6.8
• CVE-2024-41712A vulnerability in the Web Conferencing Component of Mitel M…6.6
• CVE-2024-41713A vulnerability in the NuPoint Unified Messaging (NPM) compo…9.1
• CVE-2024-41714A vulnerability in the Web Interface component of Mitel MiCo…8.8
• CVE-2024-41715The goTenna Pro ATAK Plugin does not inject extra characters…4.3