CVE-2024-51312 in TX9
Summary
by MITRE • 07/21/2026
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
The Tenda TX9 router running firmware version V22.03.02.20 contains a critical stack overflow vulnerability within its web interface management functionality. This flaw exists in the sub_42EEE0 function located in the /goform/SetStaticRouteCfg file, which handles static route configuration requests through the web administration interface. The vulnerability arises from insufficient input validation and bounds checking when processing user-supplied data sent to the router's configuration API endpoint, creating a dangerous condition where maliciously crafted parameters can overwrite adjacent memory locations on the stack.
This stack overflow represents a severe security weakness that can be exploited by remote attackers without authentication requirements. The vulnerability falls under CWE-121 Stack-based Buffer Overflow, which is classified as a critical threat in cybersecurity frameworks due to its potential for arbitrary code execution and system compromise. When an attacker successfully triggers this flaw through carefully crafted HTTP requests to the affected API endpoint, they can manipulate the program's execution flow by overwriting return addresses and function pointers stored on the stack, potentially allowing full system control.
The operational impact of this vulnerability extends beyond simple remote code execution to encompass complete system compromise and persistent backdoor access. Attackers who exploit this weakness could gain root-level privileges on the affected router, enabling them to modify network configurations, intercept traffic, establish persistent access points, or use the device as a pivot for attacking internal networks. The vulnerability affects all users of the specific firmware version across different geographical regions where the Tenda TX9 model is deployed, creating widespread exposure given the device's common use in residential and small office environments.
Security professionals should implement immediate mitigations including firmware updates from Tenda, network segmentation to isolate affected devices, and monitoring for suspicious traffic patterns targeting the vulnerable API endpoint. The ATT&CK framework categorizes this vulnerability under T1210 Exploitation of Remote Services and T1059 Command and Scripting Interpreter, indicating that exploitation could lead to lateral movement within networks and persistent access. Network administrators should also consider implementing intrusion detection systems to monitor for requests containing overly long parameter values or malformed input patterns that could indicate exploitation attempts against this specific stack overflow vulnerability in the router's web management interface.