CVE-2024-4252

A vulnerability classified as critical has been found in Tenda i22 1.0.0.3(4687). This affects the function formSetUrlFilterRule. The manipulation of the argument groupIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-262143. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-121
• CWE-787

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i22/formSetUrlFilterRule.mdBroken Link
• https://vuldb.com/?ctiid.262143Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.262143Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.319840Third Party Advisory, VDB Entry
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i22/formSetUrlFilterRule.mdBroken Link
• https://vuldb.com/?ctiid.262143Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.262143Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.319840Third Party Advisory, VDB Entry

Published

Apr 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4251A vulnerability was found in Tenda i21 1.0.0.14(4656). It ha…8.8
• CVE-2024-42512Vulnerability in the OPC UA .NET Standard Stack before 1.5.3…8.6
• CVE-2024-42513Vulnerability in the OPC UA .NET Standard Stack before 1.5.3…5.3
• CVE-2024-42514A vulnerability in the legacy chat component of Mitel MiCont…8.1
• CVE-2024-42515Glossarizer through 1.5.2 improperly tries to convert text i…9.9
• CVE-2024-42516HTTP response splitting in the core of Apache HTTP Server al…7.5
• CVE-2024-42520TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer over…9.8
• CVE-2024-42523publiccms V4.0.202302.e and before is vulnerable to Any File…7.2
• CVE-2024-4253A command injection vulnerability exists in the gradio-app/g…9.1
• CVE-2024-42531Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauth…9.8
• CVE-2024-42533SQL injection vulnerability in the authentication module in …9.8
• CVE-2024-4254The 'deploy-website.yml' workflow in the gradio-app/gradio r…7.1