CVE-2024-0540: Tenda W9 · Stack-based Buffer Overflow
Affects Tenda W9Source CVE Database V5
Not known to be exploited · CVSS 6.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 15 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
2) Isolate these devices from direct internet exposure by placing them behind firewalls or VPNs to limit remote access to the httpd service. 3) Restrict management interfaces to trusted internal networks and enforce strict access controls and network segmentation to minimize attack surface. 4) Monitor network traffic for unusual patterns or attempts to exploit the ssidIndex parameter, using intrusion detection systems with custom signatures if possible. 5) Consider replacing affected devices with models from vendors with active security support if mitigation is not feasible. 6) Regularly review and update network device firmware once a patch becomes available, and subscribe to vendor or vulnerability advisories for updates. 7) Employ network-level protections such as web application firewalls or reverse proxies to filter malicious payloads targeting the vulnerable function.
Description
A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. Affected is the function formOfflineSet of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.