cbcvebase.
CVE-2024-40416
published 2024-07-15

CVE-2024-40416: A vulnerability in /goform/SetVirtualServerCfg in the sub_6320C function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow.

PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.58%
43.7th percentile
A vulnerability in /goform/SetVirtualServerCfg in the sub_6320C function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow.

Affected

1 ranges
VendorProductVersion rangeFixed in
tendaax1806_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/goform/SetVirtualServerCfg↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda SetVirtualServerCfg list Parameter Buffer Overflow Attempt (CVE-2025-29361, CVE-2024-4112, CVE-2024-40416, CVE-2024-10282, CVE-2025-65220)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:27; content:"/goform/SetVirtualServerCfg"; fast_pattern; http.request_body; content:"list|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2024-4112; reference:url,www.cve.org/CVERecord/SearchResults?query=SetVirtualServerCfg; reference:cve,2025-29361; reference:cve,2024-10282; reference:cve,2024-40416; reference:url,github.com/peris-navince/founded-0-days/blob/main/Tenda/ac8/formSetVirtualSer/1.md; reference:cve,2025-65220; classtype:web-application-attack; sid:2065157; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_10, cve CVE_2024_40416_CVE_2024_4112_CVE_2024_10282_CVE_2025_29361, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit traffic is HTTP POST to the exact URI /goform/SetVirtualServerCfg (URI length is exactly 27 bytes); match on this path to identify targeting of the vulnerable endpoint.
  • →The exploit delivers the overflow via the `list` parameter in the POST body; look for the literal string 'list=' (hex: list|3d|) in the HTTP request body.
  • →The overflow payload is characterised by a `list` parameter value exceeding 100 characters before the next '&' delimiter or end of body; use PCRE /^[^&]{100,}(?:&|$)/R against the body after matching 'list='.
  • →Traffic is plaintext HTTP (not TLS); the attack targets networking equipment (Tenda routers) and is expected on perimeter and internal deployment points.
  • →MITRE mapping: Initial Access (TA0001) via Exploit Public-Facing Application (T1190); correlate web-application-attack alerts on Tenda device management interfaces with this technique.
  • ·The Snort/Suricata rule (sid:2065157) covers five CVEs simultaneously (CVE-2025-29361, CVE-2024-4112, CVE-2024-40416, CVE-2024-10282, CVE-2025-65220); a positive alert cannot be attributed solely to CVE-2024-40416 without additional context (e.g., targeted device model Tenda AX1806 vs. AC8).
  • ·The vulnerable firmware version is specifically Tenda AX1806 1.0.0.1; the same endpoint path exists on other Tenda models covered by sibling CVEs, so version/model fingerprinting is needed to confirm CVE-2024-40416 specifically.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.